Use after free in Ozone in Google Chrome on Linux prior to 149

CVE-2026-10899 is a use-after-free in Chrome's Ozone layer on Linux. Affected builds are Google Chrome on Linux prior to 149.0.7827.53; the flaw is reached from hostile web content, but the published description says the attacker must convince the victim to perform a specific interaction, which materially narrows exploit reliability and campaign scale.

Google's HIGH / 7.5 baseline is defensible in a vacuum because memory corruption in a browser can become code execution. In real enterprise fleets, though, this one is Linux-only, user-driven, marked AC:H, has no KEV listing, and there is no public exploitation evidence or public PoC located from the source set, so the vendor score overshoots the practical patching urgency.

Why this verdict

• Linux-only cuts the exposed population. Start from the vendor's 7.5, then mark down because this is not a cross-platform Chrome issue; in most enterprises the Linux desktop/browser fleet is a minority slice.
• Specific interaction is compounding friction. The attacker needs the victim not just to browse, but to perform a particular action, which lowers success rates versus one-click or no-click browser exploitation.
• AC:H is real here, not decorative. High-complexity browser memory corruption usually means timing, state, or environment sensitivity; that is downward pressure on operational exploitability.
• No KEV, no public exploitation, no public PoC. There is no current signal that attackers are widely weaponizing this CVE, so there is no reason to treat it like a zero-day response event.
• Impact is strong but often browser-context first. Even if exploitation works, the most common near-term win is browser/session compromise; meaningful host takeover often depends on chaining or privileged user context.

Why not higher?

If this were cross-platform, no-click, or already showing active exploitation, it would stay in HIGH or rise further. The current fact pattern is narrower: Linux-only exposure, required user interaction, and no exploitation signal materially suppress enterprise urgency.

Why not lower?

It is still an internet-fed memory corruption bug in a mainstream browser. A successful exploit can be serious on the endpoints that matter most, especially developer/admin Linux workstations with valuable sessions, source code, cloud tokens, or production access.

1. Constrain risky browsing on privileged Linux workstations — Move admin, SRE, and developer Linux endpoints that hold cloud, VPN, CI/CD, or production tokens into stricter browsing policy groups. For a MEDIUM verdict there is no mitigation SLA, so do this in your normal hardening cycle while you roll the patch.
2. Prioritize version visibility for Linux Chrome — Make sure your endpoint inventory can distinguish Chrome/Chromium versions on Linux and report anything below 149.0.7827.53. There is no mitigation SLA — go straight to the 365-day remediation window, but browsers should usually be swept in the next routine update ring, not left to drift.
3. Watch for browser exploit fallout — Hunt for Chrome-originated child processes, suspicious downloads, odd outbound connections, credential-store access, and crash spikes on Linux hosts. This is a containment aid, not a fix, and for MEDIUM there is no mitigation SLA attached.
4. Use isolation for high-risk web activity — Where you already have remote browser isolation or VDI jump boxes for untrusted browsing, steer your highest-value Linux users there until patch coverage is complete. With a MEDIUM verdict, deploy via normal operational change rather than emergency motion.

Run this on the target Linux endpoint or through your EDR/SSH fleet runner. Invoke it as bash check_chrome_cve_2026_10899.sh with normal user privileges; it checks installed google-chrome, google-chrome-stable, chromium, or chromium-browser binaries and reports VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env bash
# check_chrome_cve_2026_10899.sh
# Detect exposure to CVE-2026-10899 on Linux based on local Chrome/Chromium version.
# Affected: Google Chrome on Linux prior to 149.0.7827.53
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u
FIXED_VERSION="149.0.7827.53"
FOUND=0
STATUS="UNKNOWN"
DETAILS=""

version_lt() {
  # returns 0 if $1 < $2
  local a b IFS=.
  read -r -a a <<< "$1"
  read -r -a b <<< "$2"
  local len=${#a[@]}
  if [ ${#b[@]} -gt "$len" ]; then len=${#b[@]}; fi
  for ((i=0; i<len; i++)); do
    local ai=${a[i]:-0}
    local bi=${b[i]:-0}
    # force base-10
    ai=$((10#$ai))
    bi=$((10#$bi))
    if (( ai < bi )); then return 0; fi
    if (( ai > bi )); then return 1; fi
  done
  return 1
}

check_bin() {
  local bin="$1"
  local ver raw
  if ! command -v "$bin" >/dev/null 2>&1; then
    return
  fi
  FOUND=1
  raw="$($bin --product-version 2>/dev/null || $bin --version 2>/dev/null || true)"
  ver="$(printf '%s' "$raw" | grep -Eo '[0-9]+(\.[0-9]+){2,3}' | head -n1)"

  if [ -z "$ver" ]; then
    DETAILS+="$bin: unable to parse version from '$raw'\n"
    return
  fi

  if version_lt "$ver" "$FIXED_VERSION"; then
    STATUS="VULNERABLE"
    DETAILS+="$bin: $ver < $FIXED_VERSION\n"
  else
    if [ "$STATUS" != "VULNERABLE" ]; then
      STATUS="PATCHED"
    fi
    DETAILS+="$bin: $ver >= $FIXED_VERSION\n"
  fi
}

check_bin google-chrome
check_bin google-chrome-stable
check_bin chromium
check_bin chromium-browser

if [ "$FOUND" -eq 0 ]; then
  echo "UNKNOWN - No Chrome/Chromium binary found in PATH"
  exit 2
fi

printf "%b" "$DETAILS"
case "$STATUS" in
  VULNERABLE)
    echo "VULNERABLE"
    exit 1
    ;;
  PATCHED)
    echo "PATCHED"
    exit 0
    ;;
  *)
    echo "UNKNOWN"
    exit 2
    ;;
esac

Sources

1. Chrome Releases - Early Stable Update for Desktop (149.0.7827.53/.54)
2. Canadian Centre for Cyber Security - Google Chrome security advisory AV26-544
3. CISA Known Exploited Vulnerabilities Catalog
4. FIRST EPSS API documentation
5. FIRST EPSS model overview
6. Chrome Releases - Stable Channel Update for Desktop (example prior Ozone UAF, CVE-2026-2321)
7. Chrome Releases - Stable Channel Update for Desktop (example prior Ozone UAF, CVE-2025-12438)