CVE-2026-10972: Use after free in Ozone in Google Chrome on Linux prior to 149

Synopsis

Use-after-free in the Ozone display platform layer of Google Chrome on Linux allows a remote attacker to escape the Chrome renderer sandbox via a crafted HTML page. The vulnerability is reachable over the network with no authentication required, though the victim must open a malicious page. Successful exploitation gives the attacker code execution outside the browser sandbox, enabling full read, write, and crash-level impact on the host process. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected Chrome version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing or luring the victim to a crafted HTML page hosted on an attacker-controlled server.

• AuthenticationNot required

  No account or credential is required; any unauthenticated user browsing to the malicious page is a viable target.

• Victim interactionRequired

  The victim must open or be redirected to the attacker's crafted HTML page, making this a social-engineering or malicious-link scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no race condition, specific memory layout, or other environmental precondition.

Blast Radius

• Attacker escapes the Chrome renderer sandbox and gains code execution in the context of the browser process on the Linux host.
• With sandbox escape achieved, the attacker reads files, credentials, and session data accessible to the user running Chrome.
• The attacker writes or modifies files and data within the same user's permissions on the host filesystem.
• The attacker crashes the browser process or any subprocess it controls, disrupting the user's session and any dependent services.