Use after free in Chromoting in Google Chrome on Mac prior to 149

The flaw is a use-after-free in Chrome's Chromoting code that can lead to arbitrary code execution on macOS systems running Google Chrome before 149.0.7827.53. In plain English: a remote attacker can send malformed Chromoting traffic that causes Chrome to keep using memory after it has been freed, creating a path to controlled memory corruption and eventual code execution in the browser process.

The raw bug class is ugly, but the practical reachability is narrower than a generic browser RCE. The decisive friction is that this sits in Chromoting, not the mainstream HTML/JS rendering path every user hits all day. That means the vendor-style severity is directionally understandable, but for enterprise patch triage this is not the same operational emergency as a no-click renderer bug with active exploitation.

Why this verdict

• Down from vendor-style worst case: the bug sits in Chromoting, which sharply narrows the reachable population versus a generic webpage-driven browser RCE
• Still serious: AV:N/PR:N/UI:N means once the attacker can feed the vulnerable traffic path, there is no auth or user click saving you
• Further downward pressure: no KEV entry, no public PoC found, and the supplied EPSS 0.00159 all argue against emergency-all-hands treatment

Why not higher?

I am not calling this CRITICAL because the attack chain appears to depend on a specialized remoting path rather than routine browsing, and that is a huge population reducer in real fleets. On top of that, there is no verified in-the-wild exploitation signal, no KEV listing, and no public exploit kit lowering attacker cost.

Why not lower?

I am not pushing this to MEDIUM because the bug class is still memory corruption with potential arbitrary code execution, and the supplied vector says remote / no auth / no UI. If you do have Macs using Chrome Remote Desktop or adjacent Chromoting workflows, the impact of a successful exploit is full endpoint compromise territory.

1. Disable Chromoting where unused — If your estate does not need Chrome Remote Desktop or related Chromoting workflows, turn it off and remove it from managed Macs. For a HIGH verdict, deploy this containment within 30 days; for teams with heavy remote-support usage, do the discovery and disablement decision in the first wave.
2. Restrict outbound remoting paths — Use MDM, browser policy, and egress controls to block or tightly scope Chrome Remote Desktop/Chromoting traffic to approved support workflows only. This reduces the reachable population immediately and should be in place within 30 days.
3. Prioritize macOS Chrome inventory — Build a targeted list of Macs running Chrome older than 149.0.7827.53 and intersect it with users or groups authorized for remote-support tooling. That gives you the true at-risk slice instead of treating every Chrome install as equally exposed; complete that targeting work within 30 days.
4. Tune EDR for browser-to-shell pivots — Harden detections for Google Chrome spawning shells, interpreters, installers, or unusual child processes on macOS. This will not prevent the memory bug, but it improves your chance of catching post-exploitation activity while the patch rolls out; tune within 30 days.

Run this on the target Mac endpoint or through your MDM remote shell, not from an auditor workstation. Invoke it as bash check_chrome_cve_2026_10887.sh or sudo bash check_chrome_cve_2026_10887.sh; admin rights are not usually required if Chrome is installed in /Applications, but sudo helps in locked-down environments.

#!/bin/bash
# check_chrome_cve_2026_10887.sh
# Purpose: Check whether Google Chrome on macOS is below the fixed version for CVE-2026-10887.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

APP_PATH="/Applications/Google Chrome.app"
INFO_PLIST="$APP_PATH/Contents/Info.plist"
FIXED_VERSION="149.0.7827.53"

version_ge() {
  # returns 0 if $1 >= $2
  [ "$1" = "$2" ] && return 0
  local IFS=.
  local i
  local -a va=($1) vb=($2)

  # pad shorter array with zeros
  for ((i=${#va[@]}; i<${#vb[@]}; i++)); do va[i]=0; done
  for ((i=${#vb[@]}; i<${#va[@]}; i++)); do vb[i]=0; done

  for ((i=0; i<${#va[@]}; i++)); do
    if ((10#${va[i]} > 10#${vb[i]})); then
      return 0
    fi
    if ((10#${va[i]} < 10#${vb[i]})); then
      return 1
    fi
  done
  return 0
}

if [ ! -d "$APP_PATH" ] || [ ! -f "$INFO_PLIST" ]; then
  echo "UNKNOWN: Google Chrome.app not found at $APP_PATH"
  exit 2
fi

VERSION=$(/usr/bin/defaults read "$APP_PATH/Contents/Info" CFBundleShortVersionString 2>/dev/null || true)

if [ -z "$VERSION" ]; then
  echo "UNKNOWN: Unable to read Chrome version from Info.plist"
  exit 2
fi

if version_ge "$VERSION" "$FIXED_VERSION"; then
  echo "PATCHED: Google Chrome version $VERSION is >= $FIXED_VERSION"
  exit 0
else
  echo "VULNERABLE: Google Chrome version $VERSION is < $FIXED_VERSION"
  exit 1
fi

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop (June 2, 2026)
2. Chrome Releases blog
3. Chromium issue 505204771
4. Canadian Centre for Cyber Security advisory AV26-544
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS
7. FIRST EPSS API