CVE-2026-10918: Use after free in Viz in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability exists in the Viz component of Google Chrome prior to version 149.0.7827.53. The flaw is reachable over the network and requires no authentication, but the attacker must have already compromised the renderer process and must trick a user into visiting a crafted HTML page. Successful exploitation enables a sandbox escape, giving the attacker code execution outside Chrome's renderer sandbox with high impact to confidentiality, integrity, and availability. A patched-image rebuild at 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the target service or user must be reachable from an external or network-adjacent origin.

• AuthenticationNot required

  No credentials or account are needed; the attack is initiated by luring a user to a page the attacker controls.

• Victim interactionRequired

  The user must visit a crafted HTML page, requiring a social-engineering step such as a phishing link or malicious redirect.

• Attack complexityDetail

  Exploitation is rated High complexity because the attacker must first have compromised the renderer process before the use-after-free can be leveraged for a sandbox escape.

Blast Radius

• A successful attacker escapes the Chrome renderer sandbox and gains code execution in the context of the browser process or the host user account.
• With sandbox escape achieved, the attacker reads files, credentials, and session data accessible to the browser process on the host.
• The attacker can write to or modify files and browser-managed data stores on the host system.
• The attacker can crash or destabilize the browser process and potentially disrupt other processes running under the same user account.