CVE-2026-10939: Chrome WebRTC Use-After-Free Remote Code Execution

Technical summary

CVE-2026-10939 is a use-after-free vulnerability (CWE-416) in the WebRTC implementation of Google Chrome. The flaw stems from improper memory management in WebRTC handlers, allowing an attacker to reference memory that has already been freed. By crafting a specially designed HTML page, a remote attacker can trigger this condition and achieve arbitrary code execution in the sandboxed Chrome process. The vulnerability requires user interaction to visit the malicious page but does not require any special browser configuration or additional privileges. The Chromium security team rated this as High severity.

Business impact

An attacker exploiting this vulnerability could execute malicious code within a user's Chrome browser sandbox, potentially leading to credential theft, malware installation, or lateral movement to other systems on the network. For organizations where employees regularly browse the internet, this represents a significant risk vector. The requirement for user interaction (visiting a crafted page) makes this a credible attack surface for targeted campaigns or watering hole attacks. Affected users include any individual or organization running vulnerable versions of Chrome on Windows, macOS, or Linux.

Affected systems

Google Chrome versions prior to 149.0.7827.53 are vulnerable across Windows, macOS, and Linux platforms. The vulnerability is a Chrome-specific defect in the WebRTC component, though the source data lists macOS, Windows, and Linux kernel as affected systems contexts, indicating the browser runs on these operating systems. Organizations should inventory Chrome installations and prioritize updating to version 149.0.7827.53 or later.

Exploitability

Exploitability is moderately high. The attack requires a user to visit a malicious webpage, which can be achieved through phishing, watering hole attacks, or malvertising. However, once a user visits the crafted page, no additional user action or browser configuration is needed—the vulnerability is triggered automatically. The attack is not complex to execute; the attacker simply needs to host the malicious HTML and get a target user to visit it. Given the widespread use of Chrome and the prevalence of browsing activity, this is a practical exploitation vector.

Remediation

Organizations should immediately update Google Chrome to version 149.0.7827.53 or later. Chrome includes auto-update functionality, but administrators should verify that updates are deployed and not deferred. For managed environments, enforce update policies to ensure no instances remain on vulnerable versions. End users should check their Chrome version (chrome://version) and manually trigger an update if necessary. No workaround exists; patching is the only mitigation.

Patch guidance

Update Google Chrome to version 149.0.7827.53 or later. Verify the patch version in Settings > About Google Chrome, which will show the current version and automatically check for updates. For enterprise deployments, use Chrome's group policy or mobile device management (MDM) solutions to force updates across managed devices. Monitor your environment to confirm all Chrome instances have reached the patched version before considering the vulnerability remediated. Check the official Google Chrome release notes to confirm 149.0.7827.53 contains the CVE-2026-10939 fix.

Detection guidance

Monitor for Chrome process anomalies following visits to untrusted websites. Log WebRTC-related crashes or renderer process terminations, which may indicate exploitation attempts. Endpoint detection and response (EDR) tools should flag suspicious code execution within Chrome sandbox boundaries. Network-based detection is limited since the attack occurs post-compromise; focus on behavioral indicators such as unexpected child processes spawned from Chrome or unusual file system modifications initiated by the browser. Security teams should also monitor for watering hole attacks targeting their user base and correlate with Chrome update status across the organization.

Why prioritize this

This vulnerability merits immediate attention (CVSS 8.8 HIGH) because it combines high impact (arbitrary code execution), moderate exploitability (user click required but no additional complexity), and broad reach (all Chrome users across major operating systems). The use-after-free class of vulnerability is well-understood by attackers, and WebRTC is a frequently-targeted component. The lack of KEV designation does not indicate low risk; rather, it reflects that as of the source data date, no widespread exploitation in the wild has been publicly disclosed. However, given the severity and ease of exploitation, expect threat actors to develop exploits rapidly if not already done. Organizations should treat this as a critical update priority.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects: (1) Network-based attack vector (AV:N) requiring no local access; (2) Low attack complexity (AC:L) indicating the exploit does not require special conditions; (3) No privileges required (PR:N); (4) User interaction required (UI:R), which moderates the score from critical to high; (5) Confidentiality, integrity, and availability all severely impacted (C:H/I:H/A:H) due to arbitrary code execution within the sandbox. The user interaction requirement prevents this from being CRITICAL, but the sandbox escape potential and broad applicability across platforms justify the HIGH rating.

Frequently asked questions