CVE-2026-12462: Use after free in Media in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability exists in the Media component of Google Chrome versions prior to 149.0.7827.155. The flaw is reachable over the network but requires the attacker to have already compromised the renderer process and to lure a user into visiting a crafted HTML page; exploitation is conditional on a high-complexity attack chain. Successful exploitation lets the attacker execute arbitrary code inside the Chrome sandbox. A patched-image rebuild at version 149.0.7827.155 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page hosted on an attacker-controlled server.

• AuthenticationNot required

  No credentials or account privileges are needed; the attack is launched against an unauthenticated browser session.

• Victim interactionRequired

  The victim must visit or be redirected to a crafted HTML page, requiring a social-engineering or drive-by delivery step.

• Attack complexityDetail

  Exploitation is rated high complexity because the attacker must first have compromised the renderer process before leveraging the use-after-free, introducing significant preconditions beyond the attacker's direct control.

Blast Radius

• The attacker executes arbitrary code within the Chrome sandbox, gaining a foothold for further sandbox-escape attempts.
• Confidential data accessible to the renderer process, such as page content, stored credentials, and session tokens rendered in the browser, can be read.
• The attacker can modify in-memory state and data being processed by the renderer, including page content and form data before submission.
• The affected Chrome process can be crashed or destabilized, disrupting the user's browsing session.