CVE-2026-12023: Use after free in GPU in Google Chrome on Mac prior to 149

Synopsis

Use-after-free in the GPU component of Google Chrome on macOS affects versions prior to 149.0.7827.115. The vulnerability is reachable over the network, requires no authentication, but does require the attacker to have already compromised the renderer process and to lure a victim into visiting a crafted HTML page. Successful exploitation allows the attacker to escape Chrome's sandbox, gaining the ability to read, modify, or disrupt data and processes outside the browser's isolated environment. A patched-image rebuild at version 149.0.7827.115 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing a victim to a crafted HTML page hosted on an attacker-controlled server.

• AuthenticationNot required

  No account or credential is needed; the attack is reachable by any unauthenticated visitor to the malicious page.

• Victim interactionRequired

  The victim must open a crafted HTML page in the browser, requiring the attacker to socially engineer a click or redirect.

• Attack complexityDetail

  Attack complexity is high, meaning the attacker must first have compromised the renderer process before the use-after-free in the GPU layer can be weaponized for sandbox escape.

Blast Radius

• The attacker escapes Chrome's sandbox and gains code execution in the context of the browser process on the host macOS system.
• Confidential data accessible to the browser process, including stored credentials, session tokens, and local file paths, becomes readable.
• The attacker can modify files and state outside the sandbox, including writing to the user's home directory or injecting into other processes.
• The browser process and dependent services can be crashed or disrupted, causing loss of availability for the affected user session.