CVE-2026-12029: Use after free in Video in Google Chrome on Windows prior to 149

Synopsis

A use-after-free vulnerability in the Video component of Google Chrome on Windows allows a remote attacker who has already compromised the renderer process to escape Chrome's sandbox via a crafted HTML page. The attack requires the victim to visit a malicious page and operates over the network, though it involves high attack complexity. Successful exploitation gives the attacker full read, write, and availability impact beyond the sandbox boundary, effectively granting arbitrary code execution at the host OS level. A patched-image rebuild at version 149.0.7827.115 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page, so the Chrome instance must be reachable in the sense that the user browses to an attacker-controlled URL.

• AuthenticationNot required

  No credentials or account are needed; any unauthenticated remote attacker can serve the malicious page.

• Victim interactionRequired

  The victim must open a crafted HTML page in the affected browser, making social engineering or a malicious link a required part of the attack chain.

• Attack complexityDetail

  Attack complexity is high, meaning the attacker must have already compromised the renderer process before the use-after-free can be leveraged for sandbox escape, introducing a significant prerequisite step.

Blast Radius

• Attacker reads sensitive data from outside the Chrome sandbox, including files, credentials, and OS-level secrets accessible to the logged-in Windows user.
• Attacker writes or modifies files and data on the host system beyond what the sandboxed renderer would normally be permitted to touch.
• Attacker can crash or destabilize host-level processes, disrupting services running on the same machine.
• Combined high confidentiality, integrity, and availability impact at the host OS scope means full code execution outside the browser sandbox is achievable.