CVE-2026-12465: Object lifecycle issue in Metrics in Google Chrome prior to 149

Synopsis

An object lifecycle flaw (a use-after-free class of bug) in the Metrics component of Google Chrome prior to version 149.0.7827.155 allows a remote attacker who has already compromised the Chrome renderer process to escape the browser sandbox via a crafted HTML page. The attack requires network reachability, no prior authentication, but does require the victim to interact with attacker-controlled content; the attacker must also satisfy elevated complexity conditions given the renderer pre-compromise requirement. Successful exploitation gives the attacker full confidentiality, integrity, and availability impact outside the sandbox. A patched-image rebuild at 149.0.7827.155 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network, typically by serving a crafted HTML page from a remote host.

• AuthenticationNot required

  No account or credential is required; the attacker interacts with an unauthenticated browser session.

• Victim interactionRequired

  The victim must visit or interact with attacker-controlled content, such as opening a malicious HTML page, making this a social-engineering-dependent attack.

• Attack complexityDetail

  Exploitation requires the attacker to have already compromised the Chrome renderer process before triggering the sandbox escape, introducing meaningful preconditions beyond a simple one-step exploit.

Blast Radius

• Reads sensitive data from outside the Chrome sandbox, including files and memory accessible to the browser process.
• Modifies data or state outside the sandbox boundary, enabling tampering with the host environment.
• Crashes or destabilizes the affected service or host process, causing a denial of service.
• Achieves full code execution at the browser process privilege level, enabling follow-on system compromise.