Use after free in Passwords in Google Chrome on Mac prior to 149

CVE-2026-10901 is a use-after-free in Chrome's Passwords component on macOS. The affected range is Google Chrome on Mac prior to 149.0.7827.53; Google's June 2, 2026 stable desktop release shipped the fix in the 149.0.7827.53/54 train for Windows/Mac, with the Chrome release post specifically listing CVE-2026-10901: Use after free in Passwords.

The supplied vendor baseline of 7.5 / High is close to reality for enterprise triage, even though Google's release bulletin grouped this CVE under its Critical bucket. The reason not to chase the higher label is simple: this is client-side, Mac-only, user-interaction-driven exploitation with no public exploitation evidence and a very low EPSS, so real-world reach is much narrower than the raw memory-corruption impact suggests.

Why this verdict

• Downgraded from the scariest browser-bug narrative: the attack starts from the web, but it is not a no-click or no-auth server exploit; the victim must be on macOS Chrome and perform specific interaction.
• Exposure is broad but not universal: Chrome is common, yet this CVE only hits the Mac slice of that estate, immediately cutting reachable population in many enterprises.
• Attacker development cost is non-trivial: use-after-free in modern Chrome plus no public PoC and a restricted bug tracker means this is more likely to be used by capable actors than by every commodity kit.
• No exploitation signal: not KEV-listed, no vendor statement of in-the-wild abuse, and the supplied EPSS 0.0008 all argue against elevating this to emergency handling.

Why not higher?

It does not clear the bar for CRITICAL because the attack chain includes user interaction, Mac-only targeting, and likely exploit-reliability challenges in a hardened modern browser. If this were being exploited in the wild, or if a reliable public PoC dropped, that call would change fast.

Why not lower?

It should not fall to MEDIUM because the bug is still unauthenticated, internet-reachable through normal browsing, and the technical impact of successful memory corruption is severe. In an estate with a meaningful Mac population, a realistic phishing or watering-hole campaign could still turn this into credential or session theft.

1. Enforce browser auto-update — Push managed Chrome update policy and verify Macs are converging on 149.0.7827.53+. For a HIGH verdict, use this as your primary compensating control and deploy it within 30 days if patch rollout is not already automatic.
2. Tighten Safe Browsing and web filtering — Make sure Chrome enterprise policy, SWG, and DNS controls block newly registered or low-reputation lure domains that would host the exploit page. This reduces step 1 success and should be validated within 30 days.
3. Restrict password-manager surface where feasible — If your environment uses a separate enterprise password manager, consider limiting Chrome's built-in password saving/filling behavior on high-risk groups to reduce reachable paths into the vulnerable component. This is a tradeoff control, not a universal recommendation, and if chosen it should be implemented within 30 days.
4. Watch for Chrome crash spikes on Macs — Build a temporary hunt around repeated Chrome crashes, especially clusters tied to a small set of external domains or immediately followed by suspicious child processes, token theft, or session reuse. This detective control should be stood up within 30 days while patch adoption is verified.

Run this on the target Mac endpoint or through your EDR remote shell. Invoke it as bash chrome_cve_2026_10901_check.sh /Applications/Google\ Chrome.app; no root is required, but the script must be able to read the app bundle metadata.

#!/bin/bash
# chrome_cve_2026_10901_check.sh
# Check Google Chrome on macOS for CVE-2026-10901 exposure.
# Affected: Google Chrome on Mac prior to 149.0.7827.53
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=VULNERABLE, 1=PATCHED, 2=UNKNOWN

set -u

APP_PATH="${1:-/Applications/Google Chrome.app}"
MIN_SAFE="149.0.7827.53"

version_lt() {
  # returns 0 if $1 < $2, else 1
  local IFS=.
  local i
  local -a va=($1) vb=($2)
  local len=${#va[@]}
  if [ ${#vb[@]} -gt $len ]; then
    len=${#vb[@]}
  fi
  for ((i=0; i<len; i++)); do
    local a=${va[i]:-0}
    local b=${vb[i]:-0}
    if ((10#$a < 10#$b)); then
      return 0
    elif ((10#$a > 10#$b)); then
      return 1
    fi
  done
  return 1
}

if [[ "$(uname -s)" != "Darwin" ]]; then
  echo "UNKNOWN: This check is intended for macOS (Darwin)."
  exit 2
fi

if [[ ! -d "$APP_PATH" ]]; then
  echo "UNKNOWN: Chrome app not found at $APP_PATH"
  exit 2
fi

PLIST="$APP_PATH/Contents/Info.plist"
if [[ ! -f "$PLIST" ]]; then
  echo "UNKNOWN: Info.plist not found at $PLIST"
  exit 2
fi

VERSION=$(/usr/bin/defaults read "$APP_PATH/Contents/Info" CFBundleShortVersionString 2>/dev/null || true)
if [[ -z "$VERSION" ]]; then
  VERSION=$(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' "$PLIST" 2>/dev/null || true)
fi

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN: Could not determine Chrome version"
  exit 2
fi

if version_lt "$VERSION" "$MIN_SAFE"; then
  echo "VULNERABLE: Google Chrome version $VERSION is older than $MIN_SAFE"
  exit 0
else
  echo "PATCHED: Google Chrome version $VERSION is at or above $MIN_SAFE"
  exit 1
fi

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop (June 2, 2026)
2. Chromium issue tracker entry 516957738
3. Chromium Security page
4. Canadian Centre for Cyber Security advisory AV26-544
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS overview
7. FIRST API documentation for EPSS