CVE-2026-12440: Use after free in DigitalCredentials in Google Chrome on Windows prior to 149

Synopsis

A use-after-free vulnerability exists in the DigitalCredentials component of Google Chrome on Windows, affecting all versions prior to 149.0.7827.155. The flaw is reachable over the network and requires no authentication, though a victim must visit a crafted HTML page. Successful exploitation enables a sandbox escape, giving the attacker full confidentiality, integrity, and availability impact on the host. A patched-image rebuild at version 149.0.7827.155 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network by serving a crafted HTML page, as indicated by AV:N in the CVSS vector.

• AuthenticationNot required

  No account or credential is needed on the target system prior to exploitation, as indicated by PR:N.

• Victim interactionRequired

  The victim must navigate to or open a crafted HTML page, making browser-delivered social engineering a prerequisite, as indicated by UI:R.

• Attack complexityDetail

  The exploit is reliable and imposes no special environmental conditions or race-window requirements on the attacker, as indicated by AC:L.

Blast Radius

• A successful attacker escapes the Chrome renderer sandbox and gains code execution at the browser process privilege level on the Windows host.
• With confidentiality impact rated High, the attacker reads files, stored credentials, and session tokens accessible to the browser process.
• With integrity impact rated High, the attacker writes or modifies data on the host, including files and registry entries reachable by the browser process.
• With availability impact rated High, the attacker disrupts or terminates the browser process and any dependent services, causing a denial of service on the affected system.