CVE-2026-10978: Use after free in Chromoting in Google Chrome on Windows prior to 149

Synopsis

A use-after-free vulnerability in the Chromoting component of Google Chrome on Windows allows a remote attacker to execute arbitrary code. The attacker must reach the target over the network and trick the victim into interacting with malicious content, but no account credentials are needed. Successful exploitation gives the attacker full control over the affected process, enabling data theft, file tampering, and service disruption. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target over the network; the vulnerable Chromoting component is exposed to over-the-network traffic.

• AuthenticationNot required

  No account credentials or session token are needed; the attacker can initiate the attack without any prior authentication.

• Victim interactionRequired

  The victim must interact with attacker-controlled content, such as visiting a malicious page or processing crafted network traffic, making this a social-engineering dependent attack.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory layout knowledge, or other environmental prerequisites.

Blast Radius

• Reads arbitrary files and in-memory data accessible to the Chrome process, including stored credentials and session tokens.
• Writes or overwrites files within the permissions of the compromised process, enabling persistent payload installation.
• Executes attacker-supplied code in the context of the Chrome renderer or broker process on the victim's Windows host.
• Crashes or destabilizes the affected Chrome instance, disrupting access to any services the user was interacting with.