CVE-2026-10990: Use after free in Glic in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability exists in the Glic component of Google Chrome versions prior to 149.0.7827.53. The flaw is reachable over the network but requires the attacker to have already compromised the Chrome renderer process and to trick a user into visiting a crafted HTML page; it carries a high CVSS score of 8.3 due to its cross-scope impact. Successful exploitation enables a sandbox escape, granting the attacker capabilities outside the browser sandbox including full confidentiality, integrity, and availability impact on affected systems. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network by serving a crafted HTML page, making the service's network exposure a prerequisite for exploitation.

• AuthenticationNot required

  No account or credential is required; the attacker needs only to lure the target to a malicious page.

• Victim interactionRequired

  The victim must visit a crafted HTML page, meaning the attacker depends on social engineering or a redirect to deliver the payload.

• Attack complexityDetail

  Attack complexity is high because the attacker must have already compromised the renderer process before this vulnerability becomes exploitable, introducing a significant prerequisite beyond the initial network delivery.

Blast Radius

• A successful sandbox escape lets the attacker execute code outside the Chrome sandbox with the privileges of the browser process, breaking the primary isolation boundary protecting the host.
• The attacker gains read access to data the browser process can reach, including stored credentials, session tokens, and local files accessible to the user account running Chrome.
• The attacker can write or modify files and system state accessible to the browser process, enabling persistent changes to the host environment.
• The attacker can crash or destabilize the browser process and potentially dependent system services, causing a denial of service on the affected host.