CVE-2026-12437: Use after free in WebShare in Google Chrome on Windows prior to 149

Synopsis

A use-after-free vulnerability in the WebShare component of Google Chrome on Windows allows a remote attacker who has already compromised the renderer process to escape the browser sandbox via a crafted HTML page. The attack requires network reachability, no authentication, but does need a victim to interact with a malicious page, and exploitation is complicated by the need to first control the renderer process. Successful exploitation gives an attacker code execution outside the Chrome sandbox, effectively gaining full access to the underlying host system. A patched-image rebuild at version 149.0.7827.155 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must deliver a crafted HTML page to the victim over the network, requiring the ability to reach the victim's browser session from a remote origin.

• AuthenticationNot required

  No account or credential is needed; the attacker only needs the victim to visit a page the attacker controls.

• Victim interactionRequired

  The victim must visit or be socially engineered into loading the crafted HTML page in an affected version of Chrome on Windows.

• Attack complexityDetail

  Exploitation is high-complexity because the attacker must have already compromised the Chrome renderer process before the use-after-free can be leveraged for a sandbox escape.

Blast Radius

• An attacker escapes the Chrome sandbox and executes arbitrary code in the context of the host Windows process, outside browser protections.
• Files, credentials, and secrets accessible to the Windows user running Chrome become readable by the attacker.
• The attacker can write to or modify files and registry state on the host, including dropping persistent malware.
• The host process and any dependent services can be crashed or destabilized, causing service disruption for the affected user session.