CVE-2026-12007: Use after free in Core in Google Chrome on Windows prior to 149

Synopsis

Use-after-free vulnerability in Google Chrome's Core component on Windows allows a remote attacker to execute arbitrary code. The attacker reaches the target over the network and requires no authentication, but does need the victim to visit or interact with a crafted HTML page. Successful exploitation gives the attacker full code execution in the context of the browser process, enabling data theft, tampering, and service disruption. A patched-image rebuild at version 149.0.7827.115 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim's browser over the network by serving a crafted HTML page from a remote origin.

• AuthenticationNot required

  No account or credentials are needed; the attacker only needs the victim to load the malicious page.

• Victim interactionRequired

  The victim must visit or be directed to a crafted HTML page, making this a social-engineering or drive-by scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions or specific memory layout.

Blast Radius

• The attacker executes arbitrary code in the Chrome browser process, gaining the same privileges as the running browser instance.
• Confidential data accessible to the browser, including stored credentials, session tokens, and locally cached files, can be read and exfiltrated.
• The attacker can write or modify data accessible to the browser process, including cookies, local storage, and downloaded files.
• The browser process can be crashed or hijacked, denying service to the user and enabling a persistent foothold for further exploitation.