CVE-2026-12449: Use after free in Chromoting in Google Chrome on Windows prior to 149

Synopsis

A use-after-free vulnerability affects the Chromoting component of Google Chrome on Windows in versions prior to 149.0.7827.155. The flaw is reached locally and requires a user to interact with a malicious file, but does not require any authentication or existing privileges. Successful exploitation gives the attacker OS-level privilege escalation, granting high-impact read, write, and denial-of-service capabilities on the host. A patched-image rebuild at version 149.0.7827.155 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network exposure is required to reach the vulnerable component.

• AuthenticationNot required

  No account credentials or prior privileges are needed; the attacker can trigger the flaw without authenticating to the system.

• Victim interactionRequired

  A local user must open or otherwise interact with a malicious file, making this exploit dependent on a social-engineering step.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special environmental factors need to be arranged.

Blast Radius

• A successful attacker achieves OS-level privilege escalation, gaining capabilities beyond their initial unprivileged context.
• Confidentiality impact is high: the attacker reads protected OS resources, credential stores, and other user data accessible at the elevated privilege level.
• Integrity impact is high: the attacker writes to or modifies protected files, registry keys, and system configurations.
• Availability impact is high: the attacker disrupts or terminates processes and services on the affected Windows host.