CVE-2026-10947: Use after free in WebRTC in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability exists in the WebRTC component of Google Chrome prior to version 149.0.7827.53. The flaw is reachable over the network without authentication, but requires a victim to visit a crafted HTML page. Successful exploitation allows a remote attacker to execute arbitrary code inside the Chrome renderer sandbox. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing or luring a victim to a crafted HTML page hosted remotely.

• AuthenticationNot required

  No account credentials or prior authentication to any service are needed to carry out the attack.

• Victim interactionRequired

  A victim must visit a crafted HTML page, making this a social-engineering-dependent attack requiring at least one deliberate or induced browser action.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• Executes arbitrary code inside the Chrome renderer sandbox, giving the attacker control over the renderer process.
• Reads sensitive data accessible to the renderer, including page content, cookies scoped to the current session, and in-memory credentials.
• Modifies page state and behavior in ways that can facilitate further exploitation or credential theft against the active user session.
• Crashes or destabilizes the affected renderer process, disrupting the user's browsing session.