CVE-2026-12467: Use after free in Extensions in Google Chrome prior to 149

Synopsis

Use-after-free in the Extensions subsystem of Google Chrome (versions prior to 149.0.7827.155) allows a remote attacker who has already compromised the renderer process to escape the browser sandbox via a crafted HTML page. The attacker must lure a victim into visiting a malicious page, and exploitation requires overcoming a high-complexity memory condition, but no authentication is needed. Successful exploitation grants the attacker full read, write, and availability impact outside the browser sandbox, potentially leading to arbitrary code execution on the host. A patched-image rebuild at version 149.0.7827.155 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the target Chrome instance must be reachable or the user must browse to an attacker-controlled origin.

• AuthenticationNot required

  No account or credentials are needed; the exploit is delivered through a publicly accessible crafted web page.

• Victim interactionRequired

  The victim must visit or be redirected to a crafted HTML page, making this a social-engineering-dependent exploit.

• Attack complexityDetail

  Exploitation is rated High complexity because the attacker must have already compromised the renderer process and must satisfy memory-state conditions for the use-after-free to be reliably triggered.

Blast Radius

• Attacker escapes the Chrome sandbox, gaining code execution in the context of the browser process on the host system.
• Confidential data accessible to the browser (stored credentials, session tokens, local files) becomes readable outside the sandbox.
• The attacker can write to or modify data on the host filesystem or inject code into other processes running under the same user account.
• The host process can be crashed or disrupted, denying service to the affected user session.