CVE-2026-12035: Use after free in Views in Google Chrome on Windows prior to 149

Synopsis

Use-after-free in the Views component of Google Chrome on Windows affects all versions prior to 149.0.7827.115. The vulnerability is reachable over the network without any authentication, but requires the victim to visit a crafted HTML page. Successful exploitation achieves heap corruption that gives the attacker full read, write, and crash capability over the affected process, enabling remote code execution or data theft. A patched-image rebuild at version 149.0.7827.115 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a remotely hosted crafted HTML page, so the service must be reachable from an external network origin.

• AuthenticationNot required

  No account or credential is required; the attacker needs only to get the victim to load the malicious page.

• Victim interactionRequired

  The victim must actively open or be redirected to a crafted HTML page, making social engineering or a malicious link the delivery mechanism.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory-layout dependencies, or environmental prerequisites beyond victim interaction.

Blast Radius

• The attacker reads process memory, including stored session tokens, cached credentials, and in-memory page content.
• The attacker writes to heap memory, enabling arbitrary code execution within the Chrome renderer or browser process.
• The attacker can crash the affected Chrome process, causing a denial of service for the user session.
• All three impact dimensions (confidentiality, integrity, availability) are rated high, so a fully weaponized exploit achieves complete compromise of the browser process sandbox boundary.