CVE-2026-10991: Use after free in V8 in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in the V8 JavaScript engine affects Google Chrome versions prior to 149.0.7827.53. The flaw is reachable over the network with no authentication required, but the attacker must convince a user to perform specific UI gestures on a crafted HTML page. Successful exploitation enables arbitrary code execution inside the Chrome sandbox. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by serving a crafted HTML page, requiring the target host to be reachable via a browser making outbound network requests.

• AuthenticationNot required

  No credentials or account are needed; the attacker only needs the victim to visit a page they control.

• Victim interactionRequired

  The attacker must convince the user to perform specific UI gestures on the crafted page, making social engineering a prerequisite for exploitation.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other unpredictable environmental factors.

Blast Radius

• Executes arbitrary code in the context of the Chrome renderer process inside the sandbox, giving the attacker a foothold for sandbox-escape chaining.
• Reads sensitive data accessible to the browser process, including session tokens, cached credentials, and page content from visited sites.
• Modifies browser state or injects content into pages, enabling credential theft or in-browser data tampering.
• Crashes or destabilizes the affected browser process, causing denial of service for the user session.