CVE-2026-10902: Critical Use-After-Free in Google Chrome Ozone – Update to 149.0.7827.53

Technical summary

CVE-2026-10902 is a use-after-free vulnerability (CWE-416) in the Ozone subsystem of Google Chrome prior to version 149.0.7827.53. The vulnerability arises from improper memory management where freed memory is dereferenced, allowing remote code execution. The attack surface is broad—any network-accessible webpage can deliver the exploit. The CVSS 3.1 score of 8.8 reflects high impact across confidentiality, integrity, and availability, with low attack complexity and no privilege escalation required on the target system.

Business impact

Successful exploitation could lead to data theft, credential harvesting, malware installation, or lateral movement into corporate networks. Browser-based attacks are particularly dangerous because they bypass traditional perimeter defenses and target end-users directly. For organizations with large Chrome deployments, this vulnerability represents a significant infection vector that could compromise sensitive business data and intellectual property.

Affected systems

Google Chrome versions prior to 149.0.7827.53 are affected across all major operating systems: Windows, macOS, and Linux. The vulnerability also technically affects the Linux kernel and macOS environments in which Chrome runs, though the practical risk is tied to Chrome's update status. Organizations should verify their deployed Chrome versions and deployment mechanisms (managed or unmanaged).

Exploitability

Exploitability is high. The attack requires only network access and user interaction—no special privileges, no system configuration bypass, and no prior authentication. An attacker could host a malicious webpage or inject the exploit into legitimate sites via compromise or advertising networks. While not in-the-wild as of the publish date according to available KEV data, the low complexity and broad attack surface mean weaponization risk is considerable. The Chromium security team classified this as Critical severity, signaling urgent real-world risk.

Remediation

Update Google Chrome to version 149.0.7827.53 or later on all endpoints. For managed environments, deploy updates via mobile device management (MDM), enterprise policy, or automated update channels. For unmanaged devices, communicate the update urgently to users. Verify deployment across Windows, macOS, and Linux systems. Consider enforcing automatic Chrome updates if not already configured.

Patch guidance

Google Chrome updates are typically delivered automatically, but verify completion across your fleet. Check chrome://version/ on each system to confirm the installed version meets 149.0.7827.53 or higher. For enterprise deployments, use Chrome policies (via Google Admin or local GPO) to force updates and set update frequency. Prioritize systems with high-risk user profiles (developers, financial teams, executives) and public-facing roles. Test updates in a pilot group before organization-wide rollout if your change management process requires it.

Detection guidance

Monitor for unusual Chrome process behavior: crashes, high CPU/memory consumption, or unexpected child processes. Network detection should flag attempts to reach known malicious domains associated with this exploit (correlate with threat intelligence feeds). Endpoint detection and response (EDR) tools should flag memory corruption patterns or suspicious code execution originating from browser processes. Log Chrome update timestamps to identify systems lagging behind the patched version. Browser telemetry (if enabled via policy) can assist in detecting exploitation attempts.

Why prioritize this

This vulnerability scores HIGH (8.8 CVSS) and should be prioritized for immediate patching due to: (1) remote, unauthenticated attack vector requiring only user interaction; (2) critical confidentiality, integrity, and availability impact; (3) ubiquitous Chrome usage across organizations; (4) Chromium's Critical severity designation; and (5) broad platform coverage (Windows, macOS, Linux). While not yet tracked as in-the-wild, the low barrier to exploitation and high-value target (browsers are trusted with credentials and sensitive data) means delay increases organizational risk substantially.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects: AV:N (network-exploitable), AC:L (low attack complexity), PR:N (no privileges required), UI:R (requires user interaction—a crafted webpage visit), S:U (no scope escalation), but C:H, I:H, A:H (high impact to confidentiality, integrity, and availability). The score appropriately captures the severity of arbitrary code execution in a process with access to credentials, cached data, and local system resources. The HIGH severity combined with Chromium's Critical classification and widespread Chrome deployment justifies immediate action.

Frequently asked questions