Use after free in Ozone in Google Chrome prior to 149

CVE-2026-10895 is a use-after-free in Chrome's Ozone layer that affects Chrome releases prior to 149.0.7827.53 on Linux and the corresponding 149.0.7827.53/.54 desktop release train called out by Google. The attacker path is straightforward on paper: deliver crafted HTML/JS, get the target to render it, and trigger memory corruption that can yield code execution in a Chrome process.

Google's HIGH 8.8 baseline is technically fair for browser memory corruption with remote delivery, but it overstates real-world enterprise impact if you read it as guaranteed endpoint takeover. The big reality checks are user interaction, Chromium's multi-process sandboxing, the absence of KEV or exploitation evidence, and the fact that Ozone bugs are usually a narrower reliability target than a generic V8 or Blink bug.

Why this verdict

• Vendor starts at 8.8 because unauthenticated remote delivery of a browser memory bug is dangerous and Chrome is everywhere
• UI:R is real downward pressure because the attacker needs the victim to render a crafted page or ad, which implies phishing, malvertising, or prior browsing influence rather than direct reachability
• Sandboxing knocks it down again because Chromium's multi-process model and locked-down renderer-style processes mean reliable endpoint compromise often needs a second bug or a strong post-exploitation technique
• Ozone is a narrower component than V8/Blink so the reachable population and exploit reliability are likely less universal than the CVSS headline suggests
• No KEV and very low EPSS remove urgency pressure; there is no current signal that operators are burning this broadly in the wild

Why not higher?

There is no KEV listing, no verified active exploitation, and no public high-confidence PoC in the reviewed sources. More importantly, Chrome's sandbox architecture means the vendor's worst-case C/I/A impact is not the same thing as reliable full-host compromise in a modern enterprise fleet.

Why not lower?

This is still a remotely delivered browser memory-corruption flaw in a massively deployed client application, so you cannot treat it like backlog dust. A single user visit to hostile content is enough to start the chain, and many enterprises have enough unmanaged browsing surface that this remains operationally important.

1. Enforce rapid browser auto-update — Use enterprise Chrome policies or your software deployment stack to keep Stable pinned to current vendor builds and eliminate version lag. For a HIGH verdict, deploy this control within 30 days if it is not already enforced, because stale browser channels are what turn client bugs into long-tail exposure.
2. Tighten web filtering for high-risk categories — Block newly registered domains, obvious malvertising routes, and uncategorized destinations at the Secure Web Gateway to cut off the delivery step. For a HIGH verdict, have the policy tightened within 30 days while the patch rollout finishes.
3. Watch for browser crash and post-browser execution anomalies — Create detections for repeated Chrome crashes followed by child-process launches, LOLBin execution, or suspicious outbound network activity from the same host. For a HIGH verdict, push those detection updates within 30 days because EDR is most likely to catch the chain after exploitation begins.
4. Reduce unnecessary risky browser features and flags — Audit for --no-sandbox, relaxed developer flags, unsupported channel builds, and local exceptions that weaken browser isolation. For a HIGH verdict, remove those deviations within 30 days because they erase the exact friction that keeps this from being CRITICAL.

Run this on the target endpoint itself or through your RMM/EDR script runner. Invoke it with python3 check_cve_2026_10895.py for auto-detection, or python3 check_cve_2026_10895.py --version "149.0.7827.52" to test a known version string; no admin rights are usually required, though managed install paths may need normal local read access.

#!/usr/bin/env python3
# check_cve_2026_10895.py
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys

PATCHED_MIN = (149, 0, 7827, 53)
VERSION_RE = re.compile(r'(\d+)\.(\d+)\.(\d+)\.(\d+)')


def parse_version(text):
    if not text:
        return None
    m = VERSION_RE.search(text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        out = (p.stdout or '') + ' ' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def detect_from_commands():
    candidates = [
        ['google-chrome', '--version'],
        ['google-chrome-stable', '--version'],
        ['chromium', '--version'],
        ['chromium-browser', '--version'],
        ['/Applications/Google Chrome.app/Contents/MacOS/Google Chrome', '--version'],
        ['/Applications/Google Chrome Canary.app/Contents/MacOS/Google Chrome Canary', '--version'],
    ]

    for cmd in candidates:
        exe = cmd[0]
        if os.path.isabs(exe) or shutil.which(exe):
            out = run_cmd(cmd)
            ver = parse_version(out)
            if ver:
                return ver, ' '.join(cmd)
    return None, None


def detect_from_windows_registry():
    if platform.system().lower() != 'windows':
        return None, None

    reg_paths = [
        r'HKLM\Software\Google\Chrome\BLBeacon',
        r'HKLM\Software\WOW6432Node\Google\Chrome\BLBeacon',
        r'HKCU\Software\Google\Chrome\BLBeacon',
    ]

    for path in reg_paths:
        out = run_cmd(['reg', 'query', path, '/v', 'version'])
        ver = parse_version(out)
        if ver:
            return ver, f'reg query {path} /v version'
    return None, None


def get_version_from_arg():
    if '--version' in sys.argv:
        idx = sys.argv.index('--version')
        if idx + 1 < len(sys.argv):
            return parse_version(sys.argv[idx + 1]), '--version argument'
    return None, None


def main():
    ver, source = get_version_from_arg()

    if ver is None:
        ver, source = detect_from_commands()

    if ver is None:
        ver, source = detect_from_windows_registry()

    if ver is None:
        print('UNKNOWN: could not determine installed Chrome/Chromium version')
        sys.exit(2)

    ver_str = '.'.join(str(x) for x in ver)
    fixed_str = '.'.join(str(x) for x in PATCHED_MIN)

    if ver < PATCHED_MIN:
        print(f'VULNERABLE: detected version {ver_str} from {source}; fixed floor is {fixed_str} or later')
        sys.exit(1)
    else:
        print(f'PATCHED: detected version {ver_str} from {source}; fixed floor is {fixed_str} or later')
        sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Google Chrome Releases - Early Stable Update for Desktop (149.0.7827.53/.54)
2. Google Chrome Releases homepage
3. Chromium multi-process architecture
4. Chromium sandbox diagnostics / sandbox overview
5. Rapid7 reference for prior Ozone UAF (CVE-2022-1487)
6. Public Chromium issue for prior Ozone UAF on Linux/Wayland
7. CISA Known Exploited Vulnerabilities Catalog
8. FIRST EPSS model documentation