CVE-2026-12443: Use after free in Web Authentication in Google Chrome prior to 149

Synopsis

Use-after-free in the Web Authentication component of Google Chrome (versions prior to 149.0.7827.155) allows a remote attacker to execute arbitrary code by delivering a crafted HTML page to a target user. The vulnerability is reachable over the network and requires no authentication, though the victim must open a malicious page. Successful exploitation gives the attacker full code execution inside the browser process, with high impact on confidentiality, integrity, and availability. A patched-image rebuild at 149.0.7827.155 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to an attacker-controlled or compromised web page; the Chrome instance must be reachable through normal browser traffic.

• AuthenticationNot required

  No account or credential of any kind is needed; any unauthenticated remote party can serve the malicious page.

• Victim interactionRequired

  The target user must open or be redirected to the crafted HTML page, making this a social-engineering or watering-hole delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory-layout prerequisites, or environmental timing.

Blast Radius

• Reads in-browser secrets including stored credentials, session cookies, and Web Authentication (WebAuthn) key material accessible to the browser process.
• Modifies browser state and can write to the local filesystem or interact with OS resources within the scope of the browser process privilege level.
• Crashes or destabilizes the affected Chrome process, disrupting the user's active session and any services relying on browser-based authentication flows.
• Provides a foothold for further exploitation of the underlying host if the browser is running with elevated or container-escape-prone privileges.