CVE-2026-14121: Use after free in Chromoting in Google Chrome on Linux prior to 150

Synopsis

A use-after-free vulnerability in the Chromoting component of Google Chrome on Linux allows a remote attacker to execute arbitrary code by sending malicious network traffic. No authentication is required and no victim interaction is needed, making this exploitable directly over the network against any exposed instance. Successful exploitation gives the attacker full code execution in the context of the affected process. A patched-image rebuild at version 150.0.7871.47 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target service over the network; any internet-exposed or internally reachable Chrome Chromoting instance is in scope.

• AuthenticationNot required

  No credentials or account of any privilege level are needed to trigger the vulnerability.

• Victim interactionNot required

  The exploit is delivered entirely through malicious network traffic; no user action such as clicking a link or opening a file is required.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory-layout dependencies, or other environmental factors to succeed.

Blast Radius

• The attacker executes arbitrary code in the context of the Chromoting process, gaining direct control over that process on the affected Linux host.
• Confidentiality is fully compromised: the attacker can read any data accessible to the process, including credentials, session state, and files reachable under the process user.
• Integrity is fully compromised: the attacker can write, modify, or delete data and configuration accessible to the process.
• Availability is fully compromised: the attacker can crash or hang the affected service at will.