CVE-2026-10906: Use after free in WebAuthentication in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in the WebAuthentication component of Google Chrome (versions before 149.0.7827.53) allows a remote attacker to corrupt heap memory. Exploitation requires no authentication but depends on the victim performing specific UI gestures after visiting a crafted HTML page; the CVSS vector (AV:N/AC:H/PR:N/UI:R) reflects that the attacker must reach the user's browser over the network and engineer that interaction under high-complexity conditions. Successful exploitation gives the attacker full read, write, and denial-of-service capability over the affected browser process. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim's browser over the network by serving a crafted HTML page from a remote origin.

• AuthenticationNot required

  No account or credential is needed; the attack is launched from an unauthenticated remote position.

• Victim interactionRequired

  The victim must visit the attacker-controlled page and perform specific UI gestures as directed, making social engineering a prerequisite.

• Attack complexityDetail

  Complexity is rated High, meaning the attacker must time or arrange the exploit around conditions such as precise heap layout or race conditions that are not entirely under their control.

Blast Radius

• A successful attacker reads sensitive data from the browser process, including stored credentials, session tokens, and page content from any open origin.
• A successful attacker writes to heap memory in the Chrome process, allowing arbitrary code injection or modification of authentication state.
• The attacker can crash the browser process entirely, denying the user access to all open tabs and web-based applications.
• Because the vulnerability sits in the WebAuthentication component, attacker-controlled code runs in a context with access to in-flight FIDO/passkey operations.