CVE-2026-10956: Chrome MimeHandlerView Use-After-Free Remote Code Execution

Technical summary

CVE-2026-10956 is a use-after-free memory corruption vulnerability (CWE-416) in Chrome's MimeHandlerView handler. The flaw occurs when MimeHandlerView references memory that has already been freed, allowing an attacker to corrupt heap state or execute arbitrary code within the renderer sandbox context. The vulnerability requires user interaction—specifically visiting a malicious HTML page—but requires no authentication or elevated privileges. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects network accessibility, low attack complexity, user interaction as the only barrier, and potential for complete confidentiality, integrity, and availability compromise within the sandboxed process.

Business impact

Successful exploitation could expose sensitive user data processed in affected browser sessions, enable credential theft, facilitate malware injection, or support supply-chain attacks if the malicious page is hosted on trusted or compromised legitimate domains. For organizations where Chrome is the standard browser, widespread exploitation could result in large-scale endpoint compromise. The sandbox containment limits but does not eliminate risk—determined attackers could chain this with a secondary sandbox-escape vulnerability to reach the host system.

Affected systems

Google Chrome versions prior to 149.0.7827.53 on Windows, macOS, and Linux are affected. The vulnerability is specific to the Chrome browser application; however, the source data lists the underlying operating systems (Windows, macOS, Linux) as affected vectors because Chrome runs on these platforms. Users on any of these OS platforms running vulnerable Chrome versions are at risk when visiting untrusted or compromised websites.

Exploitability

This is a network-exploitable vulnerability with low attack complexity. An attacker merely needs to craft a malicious HTML page and deliver it to a victim—no special network position, authentication, or client-side software vulnerabilities are required beyond the browser itself. The requirement for user interaction (visiting the page) is a modest barrier; social engineering, phishing, or compromised advertising networks could lower this friction. The use-after-free class of defect can be reliably exploited, making weaponization straightforward for skilled attackers. No public KEV listing exists as of the source data timestamp, but the high CVSS score and low exploitation barriers make prioritization urgent.

Remediation

Update Google Chrome to version 149.0.7827.53 or later immediately. Chrome's auto-update mechanism should deploy the patch automatically on next browser restart for most users; verify successful update by checking chrome://settings/help. Organizations using managed Chrome deployments should push the update through their MDM/endpoint management tools and confirm rollout completion. For air-gapped or locked-down environments, manually download and deploy the patched version from Google's official channels. Until patched, users should avoid visiting untrusted or unverified websites and consider disabling or sandboxing access to potentially risky web content if operationally feasible.

Patch guidance

Google's official security advisory for this CVE should be consulted for precise patch version details and any interim workarounds. Users should verify they are running Chrome 149.0.7827.53 or later by navigating to chrome://settings/help, which displays the installed version and will automatically check for updates. Administrators managing Chrome at scale should consult Google's Chrome Enterprise release notes to coordinate rollout timing with other security patches and organizational change management processes. Test the patched version in a non-production environment if your organization maintains separate Chrome configurations for development, QA, and production systems.

Detection guidance

Monitor for unsuccessful or unusual MimeHandlerView interactions in web traffic and browser logs—though use-after-free exploitation may leave limited forensic traces in standard browser logs. Endpoint detection and response (EDR) tools should flag abnormal child process spawning, unusual code injection patterns, or memory corruption behaviors originating from the Chrome sandbox. Network indicators include traffic to malicious or suspicious domains known to host exploit pages; correlate with user browsing history. Behavioral signals include sudden browser crashes, high CPU usage during page loads, or unexpected data exfiltration immediately after visiting specific URLs. Deploy host-based intrusion detection signatures for known MimeHandlerView attack patterns if available from your security vendor.

Why prioritize this

A CVSS 8.8 (HIGH) network-exploitable vulnerability requiring only user interaction and permitting arbitrary code execution demands immediate attention. The low attack complexity and lack of authentication barriers mean attackers can weaponize this at scale. Although sandboxing mitigates direct OS compromise, the vulnerability enables code execution within a privileged browser context where user credentials, session tokens, and sensitive data reside. The patch is available and should be deployed without delay. Organizations should treat this as a critical browser security issue requiring rollout within 24–48 hours of confirmation.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: network attack surface (AV:N), no special conditions required to exploit (AC:L), no authentication needed (PR:N), user click required but not a major barrier (UI:R), attack scope limited to the sandbox (S:U), and full impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The score appropriately weights the sandbox limitation—the vulnerability is severe within its scope but does not directly compromise the host OS. Real-world risk is further elevated by the low exploitation complexity and high likelihood of automated attack campaigns once exploitation code is public.

Frequently asked questions