CVE-2026-10908: Use after free in FullScreen in Google Chrome on Windows prior to 149

Synopsis

A use-after-free vulnerability in the FullScreen component of Google Chrome on Windows allows a remote attacker who has already compromised the renderer process to escape the Chrome sandbox via a crafted HTML page. The attacker must lure a victim into visiting a malicious page, but no authentication is required; successful exploitation gives the attacker code execution outside the Chrome sandbox, with high impact across confidentiality, integrity, and availability. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page hosted on a remote server.

• AuthenticationNot required

  No account or credential is needed; the attacker interacts with the target purely through a web page.

• Victim interactionRequired

  The victim must navigate to or be redirected to a crafted HTML page, requiring a social-engineering or watering-hole step.

• Attack complexityDetail

  Exploitation is rated high complexity because it requires the attacker to have already compromised the Chrome renderer process before triggering the sandbox escape.

Blast Radius

• Attacker escapes the Chrome sandbox and gains code execution in the context of the browser process on the Windows host.
• Reads files and secrets accessible to the browser process, including stored credentials, cookies, and session tokens.
• Modifies or deletes files and data reachable by the browser process user account.
• Crashes or destabilizes the Chrome process and any dependent services, causing loss of availability.