CVE-2026-12441: Use after free in File Input in Google Chrome on Linux prior to 149

Synopsis

A use-after-free vulnerability exists in the File Input component of Google Chrome on Linux in versions prior to 149.0.7827.155. The flaw is reachable over the network and requires no authentication, though a victim must visit a crafted HTML page for exploitation to succeed. Successful exploitation corrupts heap memory, giving an attacker the ability to read sensitive data, tamper with application state, or crash the browser, and in likely cases achieve remote code execution within the browser process. A patched-image rebuild at version 149.0.7827.155 is available on HarborGuard for environments running an affected version of Chrome on Linux.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page hosted remotely, so the Chrome instance must be reachable to the web.

• AuthenticationNot required

  No account or credential is needed; the attacker only needs the victim to load a page under the attacker's control.

• Victim interactionRequired

  A victim must actively visit the malicious HTML page, making this a social-engineering vector that requires user action such as clicking a link or navigating to the attacker-controlled URL.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other hard-to-control environmental factors.

Blast Radius

• A successful attacker reads in-browser data including session tokens, saved credentials, and page content from any open origin.
• The attacker modifies browser memory state, enabling tampering with rendered page content or in-flight data the browser is processing.
• The browser process crashes or becomes unstable, disrupting the user's session and any work in progress.
• Heap corruption at this severity level commonly provides a primitive sufficient for arbitrary code execution within the Chrome renderer or browser process on the affected Linux host.