CVE-2026-10895: Use-After-Free in Chrome Ozone Enables Remote Code Execution

Technical summary

CVE-2026-10895 is a use-after-free vulnerability (CWE-416) in the Ozone display server abstraction layer within Google Chrome. Use-after-free occurs when code attempts to access memory that has already been freed, allowing an attacker to manipulate that memory region and execute arbitrary code. The vulnerability is triggered via a specially crafted HTML page delivered over the network. The attack vector is network-based with low complexity and requires only user interaction (UI:R), making it practical for widespread exploitation. Chrome's Chromium project assigned this a Critical severity rating.

Business impact

Successful exploitation could lead to complete compromise of user browsing sessions, theft of credentials and sensitive data accessed through the browser, installation of malware or spyware, and lateral movement into corporate networks if compromised systems are used for work. The requirement for user interaction via a crafted webpage makes this a high-risk threat for any organization where employees browse the web. Widespread exploitation is possible if malicious sites hosting the exploit payload gain traffic through advertising, social engineering, or watering-hole attacks.

Affected systems

Google Chrome prior to version 149.0.7827.53 is directly affected. The vulnerability impacts Chrome running on Windows, macOS, and Linux systems. While the CVE record lists the base operating systems (Windows, macOS, Linux kernel), the practical impact is constrained to Chrome installations on those platforms—the vulnerability does not affect the OS kernels themselves, only the Chrome browser application.

Exploitability

Exploitation requires delivery of a crafted HTML page to a user and user interaction (visiting the page or clicking a link). No authentication or elevated privileges are required on the target system. The network-based attack vector and low attack complexity indicate this vulnerability is straightforward to exploit once a payload is developed. The lack of CISA KEV (Known Exploited Vulnerability) listing as of the source data date does not guarantee exploits are unavailable—it reflects only official public disclosures tracked by CISA's program. The Critical severity rating from Chromium suggests active research interest and likely rapid weaponization.

Remediation

Update Google Chrome to version 149.0.7827.53 or later immediately. Chrome's auto-update mechanism should deliver patches automatically, but users and administrators should verify updates are installed, particularly on business-managed systems. Confirm the updated version number in Chrome menu > About Google Chrome, which will also show auto-update status. No workarounds exist; patching is the only remediation.

Patch guidance

Chrome typically releases security patches automatically and rolls them out over several days. To force an immediate update, open Chrome, navigate to Settings > About Google Chrome, and the browser will check for and install pending updates. On Windows, administrators can use the Google Chrome MSI installer or Group Policy to manage updates across managed devices. macOS users can verify installation through System Preferences if MDM is deployed. Linux users should update through their distribution package manager or the official Chrome repository. Verify the installed version matches 149.0.7827.53 or later; earlier patch versions in the 149.x branch should also be confirmed against the official Chromium security advisory for completeness.

Detection guidance

Monitor Chrome crash reports and browser error logs for signs of exploitation attempts. If your organization uses browser telemetry or security monitoring, look for unexpected crashes in the Ozone subsystem or suspicious rendering engine behavior preceding a crash. Endpoint Detection and Response (EDR) tools should monitor for unusual child process spawning from the Chrome executable, memory corruption patterns, and code injection attempts. Network-level detection is challenging because the payload is delivered as an HTML page over standard HTTPS traffic, but monitoring for access to known malicious domains or unusual web traffic patterns from user machines may provide early warning. In forensics, examine Chrome cache and history for evidence of visits to compromised or attacker-controlled sites shortly before exploitation.

Why prioritize this

This vulnerability merits immediate prioritization due to the combination of high CVSS score (8.8), Critical severity designation from Chromium, network-based attack vector, minimal user interaction requirement, and widespread use of Chrome across organizations. The use-after-free class of vulnerability is well-understood and has a long history of reliable exploitation. While no public KEV entry exists yet, the structural characteristics indicate rapid exploitation is probable. Any delay in patching exposes users to compromised browsing environments with direct data theft and malware installation risks.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects the network attack vector (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), user interaction required (UI:R), unchanged scope (S:U), and high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The score appropriately captures the severity of arbitrary code execution in the browser context. However, Chromium's separate 'Critical' designation acknowledges that browser-based RCE has amplified real-world impact due to Chrome's ubiquity and the sensitivity of data processed in modern web applications. The UI:R element prevents a perfect 9.0 score but does not materially reduce practical risk given the ease of social engineering users to visit a link.

Frequently asked questions