CVE-2026-10933: Use after free in Audio in Google Chrome on Windows prior to 149

Synopsis

A use-after-free vulnerability exists in the Audio component of Google Chrome on Windows in versions prior to 149.0.7827.53. The flaw is reachable over the network but requires victim interaction and a pre-compromised renderer process; an attacker who has already broken into the renderer can deliver a crafted HTML page to trigger the bug. Successful exploitation enables a full sandbox escape, giving the attacker high-impact access to confidentiality, integrity, and availability outside the browser sandbox. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the targeted host must be reachable and the victim must browse to attacker-controlled content.

• AuthenticationNot required

  No account or credentials are needed to serve the malicious HTML page to the victim.

• Victim interactionRequired

  The victim must open or be redirected to a crafted HTML page, making a social-engineering or drive-by delivery step necessary.

• Attack complexityDetail

  Exploitation is rated high complexity because it requires the renderer process to already be compromised before the use-after-free can be leveraged for a sandbox escape.

Blast Radius

• Attacker escapes the Chrome sandbox and executes code with the privileges of the browser process on the Windows host.
• Confidential data accessible to the browser process (stored credentials, cookies, session tokens, local files) is exposed.
• Attacker can write or modify files and system state outside the sandbox, including dropping persistent malware.
• The browser process and dependent services can be crashed or made unavailable.