CVE-2026-10975: Use after free in WebRTC in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability affects the WebRTC component of Google Chrome prior to version 149.0.7827.53. The flaw is reachable over the network with no authentication required, but the victim must visit a crafted HTML page for exploitation to succeed. Successful exploitation gives a remote attacker the ability to execute arbitrary code inside the Chrome sandbox. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page hosted remotely, so the Chrome instance must be reachable to the open internet or an attacker-controlled network segment.

• AuthenticationNot required

  No account credentials or prior authentication are needed; any unauthenticated remote attacker can serve the malicious page.

• Victim interactionRequired

  The victim must actively open or be redirected to a crafted HTML page, making this a social-engineering or malicious-link scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• A successful attacker executes arbitrary code inside the Chrome renderer sandbox, gaining control of the sandboxed process.
• Confidential data processed in the browser context, such as page contents, form input, and in-memory session material, is exposed to the attacker.
• The attacker can write or modify data within the sandboxed process, including altering rendered content or injecting further payloads.
• The affected Chrome process can be crashed or made unresponsive, disrupting the user's browsing session.