CVE-2026-12464: Use after free in Browser in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in the Browser component of Google Chrome (versions prior to 149.0.7827.155) allows a remote attacker who has already compromised the renderer process to escape the browser sandbox. The attacker reaches the vulnerable code over the network and must trick the victim into opening a crafted HTML page, but no authentication is required. Successful exploitation gives the attacker code execution outside the sandbox, effectively breaking Chrome's primary isolation boundary. A patched-image rebuild at 149.0.7827.155 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page, so the Chrome instance must be reachable to load remote content.

• AuthenticationNot required

  No authentication or account credentials are needed; the attacker only needs the victim to open a malicious page.

• Victim interactionRequired

  The victim must actively open or be redirected to a crafted HTML page, making social engineering (phishing link, malicious ad, etc.) a prerequisite.

• Attack complexityDetail

  Attack complexity is High, meaning the attacker must first compromise the renderer process before leveraging this bug for sandbox escape, introducing a meaningful prerequisite step.

Blast Radius

• The attacker breaks out of the Chrome sandbox, gaining code execution in the context of the browser process on the victim's host.
• With sandbox escape, the attacker reads files, credentials, and session data accessible to the browser process outside the sandbox boundary.
• The attacker can write or modify files on the host filesystem and persist malicious code beyond the browser session.
• The attacker can crash or otherwise disrupt the browser process and any dependent services running under the same user account.