CVE-2026-10982: Use after free in WebXR in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in the WebXR component of Google Chrome prior to version 149.0.7827.53 allows a remote attacker to execute arbitrary code inside the browser sandbox. The flaw is reachable over the network without any login credentials, but requires the target user to visit a crafted HTML page. Successful exploitation gives the attacker arbitrary code execution within the Chrome sandbox, enabling further attacks depending on sandbox escape capability. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page hosted remotely.

• AuthenticationNot required

  No login credentials or account are needed; the attacker requires no prior authentication to the targeted service or host.

• Victim interactionRequired

  The victim must navigate to or be redirected to a crafted HTML page, making this a social-engineering or malicious-link scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• Attacker executes arbitrary code within the Chrome renderer sandbox, gaining control of the sandboxed process.
• Confidential data accessible to the renderer, including page content and in-memory session material, is readable by the attacker.
• The attacker can modify in-renderer state and inject content into the browsing context, affecting data integrity within the session.
• The sandboxed Chrome process can be crashed or destabilized, disrupting the user's browser session.