CVE-2026-10956: Use after free in MimeHandlerView in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in the MimeHandlerView component of Google Chrome prior to version 149.0.7827.53 allows a remote attacker to execute arbitrary code inside the Chrome sandbox by convincing a user to visit a crafted HTML page. The vulnerability is reachable over the network and requires no authentication, though it does require the victim to load attacker-controlled content in their browser. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by hosting a crafted HTML page that the victim's browser fetches remotely.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated remote attacker can attempt the exploit.

• Victim interactionRequired

  The victim must navigate to or be redirected to an attacker-controlled HTML page, making this a social-engineering or malicious-link scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other unpredictable environmental factors.

Blast Radius

• A successful attacker executes arbitrary code within the Chrome sandbox process on the victim's machine.
• Confidential data accessible to the renderer process, including page content and stored credentials surfaced by the browser, is exposed to the attacker.
• The attacker can modify data handled by the compromised renderer, including injecting content into the current browsing context.
• The affected renderer process can be crashed or made unresponsive, disrupting the user's browser session.