Use after free in Network in Google Chrome prior to 149

CVE-2026-10882 is a use-after-free in Chrome's Network stack. Google fixed it in the Chrome 149 stable release posted on June 2, 2026, covering Chrome before 149.0.7827.53 on Linux and before 149.0.7827.53/54 on Windows and macOS. The linked fix commit for bug 503420443 points at a lifetime bug in net/spdy, where a stream object could be destroyed during window-update handling and then touched again; that makes crafted page + attacker-controlled traffic shaping a credible trigger path, though some technical details remain restricted.

Vendor scoring lands at HIGH 8.8, and that is directionally fair for enterprise patching. Google’s release notes actually label this bug Critical in Chromium’s internal severity taxonomy, but in real fleets this still lands as HIGH, not CRITICAL, because there is no KEV listing, no public exploit, and no evidence of active exploitation, while modern Chrome mitigations like sandboxing, process isolation, and site isolation add real friction between a memory bug and full endpoint compromise.

Why this verdict

• Broad reachable population, but still a browser visit bug: attacker position is unauthenticated remote, yet UI:R means this is not self-propagating and still depends on web-delivery success.
• Exploit engineering is the choke point: the public patch suggests a real network lifetime bug, but reliable weaponization must survive Chrome hardening, allocator behavior, and per-build instability.
• Chrome’s fleet footprint keeps it high: even with friction, a remotely reachable bug in a top-endpoint application carries enough population and business exposure that backlog treatment would be irresponsible.

Why not higher?

There is no KEV entry, no public exploit, and no demonstrated in-the-wild use. More importantly, single-bug browser exploitation frequently stops at a crash or a sandboxed foothold unless the attacker also has a second stage, and that missing evidence is the main reason this is not CRITICAL.

Why not lower?

This is still a remote, no-auth browser memory-corruption bug in one of the most deployed enterprise applications on the planet. The only user action is opening content, and Google itself surfaced the issue as Critical in release notes, so dropping this to MEDIUM would understate real fleet risk.

1. Force browser auto-update and relaunch — Push policy-backed Chrome auto-update, then enforce relaunch so patched binaries actually replace vulnerable ones. For a HIGH verdict, deploy this compensating control within 30 days, but in practice do it in the first few days because stale browser processes are where exposure hides.
2. Block outdated Chrome from sensitive apps — Use endpoint compliance, ZTNA, or IdP device posture to deny access when Chrome is below the fixed build. This does not remove the bug, but it cuts high-value abuse paths while you finish patch coverage; deploy within 30 days.
3. Isolate risky browsing cohorts — Put admins, finance, help desk, and developers behind remote browser isolation or a hardened VDI/browser container profile for untrusted web access. This is a good temporary blast-radius reducer while patch coverage converges; deploy within 30 days.
4. Watch for crash and child-process anomalies — Hunt for repeated Chrome crashes, exploit-protection events, and suspicious child processes spawned from browser contexts. Detection is not prevention, but it is the fastest way to catch active abuse while patching catches up; enable and tune within 30 days.

Run this on the target endpoint or through your software-distribution/EDR script runner. Invoke it as python3 check_chrome_cve_2026_10882.py; it needs standard user rights on macOS/Linux and standard rights on Windows unless your environment blocks registry reads, in which case use a normal managed-user context.

#!/usr/bin/env python3
# check_chrome_cve_2026_10882.py
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import os
import platform
import plistlib
import re
import shutil
import subprocess
import sys

FIXED_VERSION = (149, 0, 7827, 53)


def parse_version(s):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', s or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_to_str(v):
    return '.'.join(str(x) for x in v)


def compare_versions(a, b):
    return (a > b) - (a < b)


def get_windows_version():
    try:
        import winreg
    except Exception:
        return None

    reg_paths = [
        (winreg.HKEY_CURRENT_USER, r'SOFTWARE\Google\Chrome\BLBeacon'),
        (winreg.HKEY_LOCAL_MACHINE, r'SOFTWARE\Google\Chrome\BLBeacon'),
        (winreg.HKEY_LOCAL_MACHINE, r'SOFTWARE\WOW6432Node\Google\Chrome\BLBeacon'),
    ]

    for hive, path in reg_paths:
        try:
            with winreg.OpenKey(hive, path) as key:
                value, _ = winreg.QueryValueEx(key, 'version')
                v = parse_version(value)
                if v:
                    return v
        except OSError:
            continue
    return None


def get_macos_version():
    plist_paths = [
        '/Applications/Google Chrome.app/Contents/Info.plist',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/Info.plist'),
    ]
    for path in plist_paths:
        if os.path.exists(path):
            try:
                with open(path, 'rb') as f:
                    data = plistlib.load(f)
                v = parse_version(data.get('CFBundleShortVersionString', ''))
                if v:
                    return v
            except Exception:
                continue
    return None


def get_linux_version():
    candidates = ['google-chrome', 'google-chrome-stable', 'chrome', 'chromium', 'chromium-browser']
    for cmd in candidates:
        exe = shutil.which(cmd)
        if not exe:
            continue
        try:
            out = subprocess.check_output([exe, '--version'], stderr=subprocess.STDOUT, text=True, timeout=5)
            v = parse_version(out)
            if v:
                return v
        except Exception:
            continue
    return None


def main():
    system = platform.system().lower()
    if system == 'windows':
        version = get_windows_version()
        product = 'Google Chrome on Windows'
    elif system == 'darwin':
        version = get_macos_version()
        product = 'Google Chrome on macOS'
    elif system == 'linux':
        version = get_linux_version()
        product = 'Google Chrome/Chromium on Linux'
    else:
        print('UNKNOWN - Unsupported OS: {}'.format(platform.system()))
        sys.exit(2)

    if not version:
        print('UNKNOWN - Could not determine installed browser version for {}'.format(product))
        sys.exit(2)

    print('Detected version: {}'.format(version_to_str(version)))
    print('Fixed threshold: {}'.format(version_to_str(FIXED_VERSION)))

    if compare_versions(version, FIXED_VERSION) >= 0:
        print('PATCHED')
        sys.exit(0)
    else:
        print('VULNERABLE')
        sys.exit(1)


if __name__ == '__main__':
    main()

Sources

1. Google Chrome stable release 149 advisory
2. Chromium issue 503420443
3. Chromium fix commit tied to bug 503420443
4. Chromium Security page
5. Chromium Security Release Management
6. Chromium Site Isolation
7. CISA Known Exploited Vulnerabilities Catalog
8. Canadian Centre for Cyber Security advisory AV26-544