CVE-2026-12451: Use after free in DigitalCredentials in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability exists in the DigitalCredentials component of Google Chrome versions prior to 149.0.7827.155. The flaw is reachable over the network and requires no authentication, but does require an attacker who has already compromised the renderer process to convince a victim to visit a crafted HTML page. Successful exploitation enables a sandbox escape, giving the attacker the ability to read sensitive data, tamper with system state, and crash or destabilize the affected process outside the browser sandbox. A patched-image rebuild at version 149.0.7827.155 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the target host must be reachable and the victim must browse to the attacker-controlled content.

• AuthenticationNot required

  No account or credential is needed to serve the malicious page; the attack begins as an anonymous network interaction.

• Victim interactionRequired

  The victim must open a crafted HTML page, meaning the attacker depends on a social-engineering or drive-by step to get the browser to load the content.

• Attack complexityDetail

  Exploitation is rated high complexity because it requires the attacker to have already compromised the renderer process before the use-after-free primitive can be used for sandbox escape, introducing a significant prerequisite condition.

Blast Radius

• The attacker escapes the Chrome renderer sandbox, gaining code execution in a less-restricted host process context.
• Sensitive data accessible to the browser process, including stored credentials, session tokens, and page content from other origins, becomes readable.
• The attacker can modify files, registry entries, or other persisted state reachable by the browser process on the host.
• The affected Chrome process and dependent services can be crashed or rendered unavailable.