CVE-2026-10954: Use after free in Actor in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in the Actor component of Google Chrome (versions before 149.0.7827.53) allows a remote attacker to execute arbitrary code inside the browser sandbox by tricking a user into visiting a crafted HTML page. The vulnerability is reachable over the network and requires no authentication, only a single user interaction (opening or clicking a link). Successful exploitation gives the attacker arbitrary code execution within the Chrome sandbox, which may serve as a stepping stone for a full sandbox escape. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the target's Chrome instance must be reachable in the sense that a user can browse to an attacker-controlled URL.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated remote attacker can serve the malicious page.

• Victim interactionRequired

  The victim must visit or be redirected to a crafted HTML page, making this a social-engineering vector that requires at least one user action such as clicking a link.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental preconditions.

Blast Radius

• The attacker executes arbitrary code inside the Chrome renderer sandbox, gaining control of that sandboxed process.
• Confidential data processed in the browser context (session tokens, form inputs, page content) is readable by the attacker.
• The attacker can write or modify data within the sandboxed process, which can serve as a base for chaining a sandbox-escape exploit to reach the host OS.
• The affected Chrome process can be crashed or destabilized, disrupting the user's browsing session.