CVE-2026-12439: Use after free in Digital Credentials in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability exists in the Digital Credentials component of Google Chrome versions prior to 149.0.7827.155. The flaw is reachable over the network but requires the victim to visit a crafted HTML page; no authentication is needed on the attacker's side. Successful exploitation corrupts heap memory, giving an attacker the ability to read sensitive data, alter browser state, or execute arbitrary code within the Chrome process. A patched-image rebuild at version 149.0.7827.155 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page, so the Chrome instance must be reachable from or browsing to an attacker-controlled origin.

• AuthenticationNot required

  No account or credential on the target system is required; the attacker only needs to get the victim to load the malicious page.

• Victim interactionRequired

  The victim must navigate to or be redirected to a crafted HTML page, making this a social-engineering or malicious-link delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special environmental conditions, race-window timing, or memory-layout prerequisites on the attacker.

Blast Radius

• A successful attacker reads in-browser secrets such as session cookies, saved credentials, and page content from the active renderer process.
• Heap corruption allows the attacker to modify browser memory, potentially altering the state of the Digital Credentials subsystem and any credentials being processed.
• Arbitrary code execution within the Chrome renderer process is achievable, enabling the attacker to pivot to further browser or OS-level actions depending on sandbox state.
• The Chrome process handling the crafted page can be crashed, disrupting the user's active session and any background processing tied to that renderer.