CVE-2026-12008: Use after free in DigitalCredentials in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in the DigitalCredentials component of Google Chrome (versions prior to 149.0.7827.115) allows a remote attacker who has already compromised the Chrome renderer process to escape the browser sandbox via a crafted HTML page. The attack is reachable over the network but requires the victim to visit a malicious page, and successful exploitation gives the attacker high-confidence code execution, data access, and the ability to tamper with or crash the host beyond the browser sandbox. A patched-image rebuild at version 149.0.7827.115 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the target Chrome instance must be reachable or directed to an attacker-controlled URL.

• AuthenticationNot required

  No account or credential is needed; any user who browses to the malicious page can be targeted.

• Victim interactionRequired

  The victim must visit the attacker-crafted HTML page, making this a social-engineering or drive-by browsing vector.

• Attack complexityDetail

  Attack complexity is rated High, meaning the attacker must first compromise the Chrome renderer process before the use-after-free can be weaponised for a sandbox escape, introducing a prerequisite environmental condition.

Blast Radius

• An attacker escaping the Chrome sandbox gains code execution in the context of the browser process on the host, bypassing the isolation boundary meant to contain renderer-level compromise.
• Confidentiality impact is high: the attacker reads data accessible to the browser process, including stored credentials, cookies, and session tokens held in the browser profile.
• Integrity impact is high: the attacker modifies files, browser state, or other data accessible to the Chrome process on the host.
• Availability impact is high: the attacker can terminate or crash the browser process and any dependent services running under the same user context.