CVE-2026-12013: Use after free in Media in Google Chrome on Windows prior to 149

Synopsis

A use-after-free vulnerability exists in the Media component of Google Chrome on Windows in versions prior to 149.0.7827.115. The flaw is reachable over the network and requires no authentication, but the victim must visit a crafted HTML page that triggers the memory corruption. Successful exploitation gives an attacker full read, write, and crash capability over the affected process, enabling data theft, content tampering, or denial of service. A patched-image rebuild at version 149.0.7827.115 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by luring the victim to a crafted HTML page, so the Chrome instance must be reachable from or browsing to an attacker-controlled origin.

• AuthenticationNot required

  No account credentials or session tokens are needed; any unauthenticated remote attacker can serve the malicious page.

• Victim interactionRequired

  The victim must navigate to or be redirected to the attacker's crafted HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special timing, race-condition, or environment prerequisites on the attacker.

Blast Radius

• An attacker gains read access to heap memory in the Chrome renderer process, exposing in-memory session tokens, form data, and page content.
• Write primitives from the heap corruption allow the attacker to modify renderer state, tamper with displayed page content, or pivot to further exploitation.
• The vulnerability can be used to crash the affected Chrome process entirely, causing denial of service for the active browsing session.
• Depending on sandbox escape primitives available on the target system, heap corruption of this class can serve as a stepping stone to arbitrary code execution on the host.