CVE-2026-10926: Use after free in Cast in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in the Cast component of Google Chrome (versions prior to 149.0.7827.53) allows an unauthenticated attacker on the same local network segment to execute arbitrary code by sending malicious network traffic to an affected browser. No user interaction and no account credentials are required. Successful exploitation gives the attacker full code execution inside the Chrome process, enabling data theft, system compromise, or further lateral movement. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected Chrome version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be present on the same local network segment, LAN, or VPN as the target; remote internet-based exploitation is not possible with this vector.

• AuthenticationNot required

  No credentials or account of any privilege level are needed to send the malicious network traffic that triggers the vulnerability.

• Victim interactionNot required

  The exploit is delivered entirely through network traffic; no action by the browser user is required.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, specific memory layout, or environmental configuration are required beyond network adjacency.

Blast Radius

• An attacker achieves arbitrary code execution inside the Chrome process on the victim host.
• Confidentiality impact is complete: the attacker reads browser session tokens, stored credentials, cookies, and any data accessible to the Chrome process.
• Integrity impact is complete: the attacker writes or modifies files and data accessible to the Chrome process, including browser profile data and downloaded files.
• Availability impact is complete: the attacker can crash or hang the browser process or consume host resources.