CVE-2026-10939: Use after free in WebRTC in Google Chrome prior to 149

Synopsis

Use-after-free in the WebRTC component of Google Chrome (versions prior to 149.0.7827.53) allows a remote attacker to execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The vulnerability is reachable over the network and requires no authentication, but does require the victim to visit a malicious page. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the target Chrome instance must be able to reach an attacker-controlled URL.

• AuthenticationNot required

  No account or credential of any kind is needed; any unauthenticated user who visits the page is exposed.

• Victim interactionRequired

  The victim must navigate to or be redirected to a crafted HTML page, making this a social-engineering-dependent attack.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, memory layout luck, or other environmental factors.

Blast Radius

• A successful attacker executes arbitrary code within the Chrome renderer sandbox, gaining full control over the renderer process.
• Confidentiality impact is high: the attacker can read data accessible to the renderer, including page content, stored credentials surfaced by autofill, and session tokens.
• Integrity impact is high: the attacker can modify page content and data written through the renderer, including form submissions and local storage.
• Availability impact is high: the attacker can crash or hang the affected browser process, disrupting the user session.