CVE-2026-12455: Use after free in Tab Strip in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability exists in the Tab Strip component of Google Chrome prior to version 149.0.7827.155. The flaw is reachable over the network but requires a victim to perform specific UI gestures on a crafted HTML page, and no authentication to the browser or any service is needed on the attacker's part. Successful exploitation corrupts heap memory and gives an attacker the ability to read sensitive data, modify application state, or crash the browser process. A patched-image rebuild at version 149.0.7827.155 is available on HarborGuard for environments running an affected Chrome version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the victim's browser must be able to reach attacker-controlled web content.

• AuthenticationNot required

  No account or credential of any kind is needed; the attack works against any unauthenticated browser session that loads the malicious page.

• Victim interactionRequired

  The victim must be convinced to perform specific UI gestures (such as interacting with browser tabs) on the crafted page, making social engineering a prerequisite.

• Attack complexityDetail

  Attack complexity is high, meaning the attacker must account for timing or environmental factors to reliably trigger the heap corruption, reducing the likelihood of a straightforward, condition-free exploit.

Blast Radius

• A successful exploit can read heap memory contents, exposing in-memory session tokens, credentials, or other sensitive page data.
• The attacker can modify heap structures, allowing tampering with browser state or data being processed in the affected tab.
• The vulnerability can be used to crash the Chrome browser process entirely, disrupting the user's session.
• In a fully weaponized exploit chain, heap corruption at this level can serve as a stepping stone toward arbitrary code execution within the browser's renderer or beyond its sandbox.