CVE-2026-10943: Use after free in WebRTC in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in the WebRTC component of Google Chrome prior to version 149.0.7827.53 allows a remote attacker to execute arbitrary code inside the browser sandbox. The attack is reachable over the network and requires no authentication, but does require the victim to visit a crafted HTML page. Successful exploitation gives the attacker arbitrary code execution within the Chrome sandbox, which is a prerequisite for further sandbox-escape chains. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the malicious HTML page over the network, so the target service or user must be reachable from the internet or an adjacent network segment.

• AuthenticationNot required

  No account or credential is needed; any anonymous visitor who loads the crafted page is a valid target.

• Victim interactionRequired

  The victim must navigate to or be redirected to a crafted HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• The attacker gains arbitrary code execution inside the Chrome renderer sandbox, enabling full control over the sandboxed process.
• Confidential data processed or displayed in the browser context, including session tokens, page contents, and form input, becomes readable to the attacker.
• The attacker can modify data within the sandboxed process, including intercepting or altering in-flight network requests made by the tab.
• The sandboxed process can be crashed or held hostage, disrupting availability of the browser session for the affected user.