CVE-2026-10988: Use after free in Views in Google Chrome prior to 149

Synopsis

Use-after-free in the Views component of Google Chrome (versions prior to 149.0.7827.53) allows a remote attacker who has already compromised the renderer process to escape the browser sandbox via a crafted HTML page. The vulnerability is reachable over the network and requires no authentication, though it does require the victim to visit or interact with a malicious page. Successful exploitation gives the attacker code execution outside the Chrome sandbox, bypassing the main isolation boundary that separates browser processes from the host. A patched-image rebuild at 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the target Chrome instance must be able to reach or load attacker-controlled content.

• AuthenticationNot required

  No account or credentials are needed; any unauthenticated user browsing the web is a valid target.

• Victim interactionRequired

  The victim must visit or be directed to a crafted HTML page, making this a social-engineering or malicious-redirect scenario.

• Attack complexityDetail

  Attack complexity is low; the exploit is reliable and does not depend on race conditions, memory layout, or other unpredictable environmental factors beyond the prerequisite renderer compromise.

Blast Radius

• Attacker escapes the Chrome sandbox and gains code execution in the context of the browser process on the host operating system.
• With sandbox escape achieved, the attacker can read files and credentials accessible to the user running Chrome, including stored session tokens and local secrets.
• The attacker can write to or modify files and persistent storage accessible to that user account.
• The attacker can crash or destabilize the browser process and any dependent services running under the same user context.