CVE-2026-10948: Use after free in WebRTC in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in the WebRTC component of Google Chrome prior to version 149.0.7827.53 allows a remote attacker to execute arbitrary code inside the browser sandbox. The attack is reachable over the network and requires no authentication, but does require the victim to visit a crafted HTML page. Successful exploitation gives the attacker arbitrary code execution within the Chrome sandbox. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page hosted on an attacker-controlled server.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated remote attacker can attempt the exploit.

• Victim interactionRequired

  The victim must visit the crafted HTML page, making this a social-engineering vector requiring the attacker to lure the user.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other unpredictable environmental factors.

Blast Radius

• Attacker executes arbitrary code inside the Chrome renderer sandbox, enabling further exploitation of the host process.
• Confidential browser data such as session tokens, stored credentials, and page content becomes readable to the attacker.
• The attacker can modify in-memory state and injected page content, tampering with data the victim sees or submits.
• The renderer process can be crashed or made unavailable, disrupting the victim's browser session.