CVE-2026-12445: Use after free in Extensions in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in the Extensions subsystem of Google Chrome allows an attacker who convinces a user to install a malicious extension to corrupt heap memory. The attack is reachable over the network but requires the victim to take a deliberate installation action, and no authentication to Chrome or a remote service is needed. Successful exploitation gives the attacker full read, write, and crash capabilities within the browser process, which can translate to arbitrary code execution or full data disclosure. A patched-image rebuild at version 149.0.7827.155 is available on HarborGuard for environments running an affected Chrome version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network, typically by distributing the malicious extension through the Chrome Web Store or another internet-accessible channel.

• AuthenticationNot required

  No authentication to Chrome or any remote service is required; the attacker only needs to persuade the victim to install the extension.

• Victim interactionRequired

  The victim must actively install a malicious Chrome extension, making social engineering the primary delivery mechanism.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker must account for heap layout or timing conditions to reliably trigger the use-after-free and achieve code execution.

Blast Radius

• An attacker gains the ability to read browser memory, exposing stored credentials, session cookies, and any data loaded in open tabs.
• Heap corruption with write primitives allows the attacker to modify in-memory browser state, including security boundaries and stored form data.
• The affected Chrome process can be crashed or destabilized, causing denial of service for the user's browsing session.
• Combined high confidentiality, integrity, and availability impact means a fully weaponized exploit achieves arbitrary code execution within the browser's privilege context.