CVE-2026-10931: Use after free in FileSystem in Google Chrome prior to 149

Synopsis

Use-after-free in the FileSystem component of Google Chrome prior to version 149.0.7827.53 allows a remote attacker to exploit deallocated memory through a crafted HTML page. The vulnerability is reachable over the network with no authentication required, but does require the victim to visit a malicious page. Successful exploitation enables a full sandbox escape, giving the attacker read, write, and denial-of-service capability outside the browser sandbox. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page hosted on an attacker-controlled server.

• AuthenticationNot required

  No account or credential of any kind is needed; the exploit is available to any unauthenticated remote party who can reach the victim's browser.

• Victim interactionRequired

  The victim must navigate to or be redirected to the attacker's crafted HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental preconditions.

Blast Radius

• Reads sensitive data from outside the browser sandbox, including files and tokens accessible to the browser process.
• Writes or modifies data outside the sandbox boundary, enabling persistent changes to the host environment.
• Crashes or disrupts the browser process and potentially dependent host services.
• Full sandbox escape means subsequent attacker actions are limited only by the privileges of the browser process on the underlying host.