Use after free in FileSystem in Google Chrome prior to 149

CVE-2026-10886 is a use-after-free in Chrome FileSystem fixed in Chrome 149.0.7827.53 for Linux and 149.0.7827.53/54 for Windows and macOS. Google lists it as affecting Chrome prior to those builds, and the vendor description plus CVSS imply a remote attacker can drive memory corruption from malicious web content with user interaction required.

Google's 9.6 / CRITICAL label is understandable in a lab because browser memory corruption plus scope change can mean full compromise. In the field, though, this is not the same as an unauthenticated server-side RCE: the attacker still needs a user to hit malicious content, then needs a reliable exploit path through modern Chrome hardening, and there is no KEV listing, no public exploitation evidence, and no public weaponized PoC surfaced from the sources reviewed.

Why this verdict

• Downward adjustment: requires user interaction — this is a browser-content bug, not a no-click service exploit; the attacker needs the victim to hit malicious content.
• Downward adjustment: exploit reliability is hard — a Chrome UAF is dangerous, but turning it into stable, cross-build sandbox escape against modern browser hardening is specialist work, not commodity work.
• Upward adjustment: Chrome is everywhere — if a working exploit exists, reachable population is huge because browsers are universal and sit next to identity tokens, SaaS sessions, and trusted user workflows.
• Downward adjustment: no current threat signal — no KEV listing, no public in-the-wild confirmation, and no public PoC found.
• Upward adjustment: scope-changing impact is plausible — the vendor vector claims S:C and full C/I/A impact, so this is not patch-later hygiene even after downgrading.

Why not higher?

I did not leave this at CRITICAL because the path assumes both victim interaction and successful exploit maturation through Chrome's sandboxing and memory-hardening layers. In practice that is a much smaller and noisier attacker set than the population that can abuse a remotely reachable unauthenticated server bug.

Why not lower?

I did not push this to MEDIUM because this is still a memory-corruption bug in the dominant enterprise browser, with vendor-assessed scope change and potentially severe post-compromise outcomes. If an attacker has a working exploit, the user-to-identity payoff is real even without broad internet scan visibility.

1. Force Chrome auto-update compliance — Use enterprise policy or your endpoint platform to verify Chrome update channels are healthy and that endpoints can actually reach Google's update infrastructure. For a HIGH verdict, deploy and validate this control within 30 days, with special focus on VDI images, kiosks, lab systems, and unmanaged remote laptops that often drift behind.
2. Block or isolate unpatched browsers — Use EDR, NAC, conditional access, VDI posture checks, or SWG policy to restrict access for endpoints still below 149.0.7827.53/54. For a HIGH verdict, have the temporary enforcement path in place within 30 days so stale clients cannot linger indefinitely.
3. Harden web delivery paths — Raise phishing-resistant controls around malicious page delivery: secure web gateway filtering, DNS filtering, browser isolation for high-risk users, and ad/malvertising suppression. These are compensating controls, not substitutes; for a HIGH verdict, tighten them within 30 days for the most exposed user groups first.
4. Tune EDR for browser child-process abuse — Alert on chrome.exe or Chrome child processes spawning unusual binaries, script interpreters, or LOLBins, and review browser crash clusters after suspicious web activity. For a HIGH verdict, deploy or validate these detections within 30 days because post-exploitation is where defenders still have leverage.
5. Prioritize high-risk user cohorts — Front-load executives, finance, admins, help desk, developers, and users who routinely touch unknown external content. For a HIGH verdict, complete that prioritization within 30 days even if full fleet hygiene takes longer.

Run this on the target endpoint or via your EDR/management agent with standard user rights; admin is only needed if your tooling restricts registry reads on Windows. Invoke it with python3 check_chrome_cve_2026_10886.py on macOS/Linux or py check_chrome_cve_2026_10886.py on Windows. It checks common Chrome install locations and outputs VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env python3
# check_chrome_cve_2026_10886.py
# Detects whether installed Google Chrome is below the fixed versions for CVE-2026-10886.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys
from pathlib import Path

FIX_LINUX = (149, 0, 7827, 53)
FIX_WIN_MAC = (149, 0, 7827, 53)  # Treat .53 and .54 as patched; anything below .53 is vulnerable.


def parse_version(s):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', s)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_str(v):
    return '.'.join(str(x) for x in v) if v else 'unknown'


def cmp_version(a, b):
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        out = subprocess.check_output(cmd, stderr=subprocess.DEVNULL, text=True).strip()
        return out
    except Exception:
        return None


def find_windows_version():
    # Try registry first
    try:
        import winreg
        reg_paths = [
            r'SOFTWARE\Google\Chrome\BLBeacon',
            r'SOFTWARE\WOW6432Node\Google\Chrome\BLBeacon'
        ]
        for hive in (winreg.HKEY_CURRENT_USER, winreg.HKEY_LOCAL_MACHINE):
            for reg_path in reg_paths:
                try:
                    key = winreg.OpenKey(hive, reg_path)
                    val, _ = winreg.QueryValueEx(key, 'version')
                    v = parse_version(val)
                    if v:
                        return v, 'registry'
                except Exception:
                    pass
    except Exception:
        pass

    # Fallback to executable paths
    candidates = [
        os.path.expandvars(r'%ProgramFiles%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%ProgramFiles(x86)%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%LocalAppData%\Google\Chrome\Application\chrome.exe'),
    ]
    for exe in candidates:
        if exe and Path(exe).exists():
            out = run_cmd([exe, '--version'])
            v = parse_version(out or '')
            if v:
                return v, exe
    return None, None


def find_macos_version():
    app = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'
    if Path(app).exists():
        out = run_cmd([app, '--version'])
        v = parse_version(out or '')
        if v:
            return v, app
    plist = '/Applications/Google Chrome.app/Contents/Info.plist'
    if Path(plist).exists():
        out = run_cmd(['/usr/libexec/PlistBuddy', '-c', 'Print :CFBundleShortVersionString', plist])
        v = parse_version(out or '')
        if v:
            return v, plist
    return None, None


def find_linux_version():
    candidates = ['google-chrome', 'google-chrome-stable', 'chrome', 'chromium', 'chromium-browser']
    for cmd in candidates:
        out = run_cmd([cmd, '--version'])
        v = parse_version(out or '')
        if v:
            return v, cmd
    desktop_paths = [
        '/opt/google/chrome/chrome',
        '/usr/bin/google-chrome',
        '/usr/bin/google-chrome-stable'
    ]
    for exe in desktop_paths:
        if Path(exe).exists():
            out = run_cmd([exe, '--version'])
            v = parse_version(out or '')
            if v:
                return v, exe
    return None, None


def main():
    sysname = platform.system().lower()
    if 'windows' in sysname:
        version, source = find_windows_version()
        fixed = FIX_WIN_MAC
    elif 'darwin' in sysname:
        version, source = find_macos_version()
        fixed = FIX_WIN_MAC
    elif 'linux' in sysname:
        version, source = find_linux_version()
        fixed = FIX_LINUX
    else:
        print('UNKNOWN: unsupported platform {}'.format(platform.system()))
        sys.exit(2)

    if not version:
        print('UNKNOWN: Google Chrome version not found')
        sys.exit(2)

    if cmp_version(version, fixed) < 0:
        print('VULNERABLE: installed Chrome {} from {} is below fixed {}'.format(version_str(version), source, version_str(fixed)))
        sys.exit(1)
    else:
        print('PATCHED: installed Chrome {} from {} meets or exceeds fixed {}'.format(version_str(version), source, version_str(fixed)))
        sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop (2026-06-02)
2. Google Chrome Releases - Early Stable Update for Desktop (2026-05-29)
3. Chromium Security Page
4. CISA Known Exploited Vulnerabilities Catalog
5. Google Chrome security advisory AV26-544 (Canadian Centre for Cyber Security)
6. CVE Record
7. NVD entry
8. FIRST EPSS API documentation