CVE-2026-10957: Use after free in Glic in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in the Glic component of Google Chrome prior to version 149.0.7827.53 allows a remote attacker to execute arbitrary code inside the browser sandbox by delivering a crafted HTML page. The exploit is reachable over the network and requires no authentication, but does require the victim to visit or interact with a malicious page. Successful exploitation gives the attacker code execution within the Chrome sandbox, which can be a stepping stone to broader compromise. A patched-image rebuild at 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the target service (a browser loading the crafted page) must be reachable or the victim must browse to an attacker-controlled URL.

• AuthenticationNot required

  No credentials or account access are needed; any anonymous user on the network can serve the malicious HTML page.

• Victim interactionRequired

  The victim must visit or be redirected to the crafted HTML page, making this a social-engineering or watering-hole style delivery.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other unpredictable environmental factors.

Blast Radius

• The attacker executes arbitrary code inside the Chrome renderer sandbox, gaining a foothold within the browser process.
• With sandbox escape (a separate step not guaranteed by this CVE alone), the attacker can read files, credentials, and session tokens accessible to the browser user.
• The attacker can modify or exfiltrate browser-stored data including saved passwords, cookies, and cached content.
• The affected browser process can be crashed or held hostage, disrupting the end user's session and any web-based workflows running in that browser.