Use after free in WebRTC in Google Chrome prior to 149

CVE-2026-10903 is a use-after-free in Chrome's WebRTC stack affecting desktop Chrome before 149.0.7827.53 on Linux and before 149.0.7827.53/54 on Windows and macOS. The vendor description says a remote attacker can use a crafted HTML page to achieve arbitrary code execution inside the renderer sandbox, which means the first-stage win is in the browser process, not a full host takeover by itself.

Google scored it HIGH 8.8, which is defensible if you look only at remote code execution against a massively deployed client. In real enterprise conditions, that score needs a trim: the code exec is explicitly sandboxed, there is no KEV listing, no public exploitation evidence surfaced in primary sources, and the disclosed bug details remain restricted, all of which makes this serious but not an automatic top-of-the-pile emergency.

Why this verdict

• Baseline starts high at 8.8 because the target is Chrome, the attack is remote, and delivery is just hostile web content against a ubiquitous client surface
• Downgrade for sandbox-only impact: the vendor description explicitly says code execution is *inside a sandbox*, so this is not a full-host compromise on its own
• Further downward pressure from field reality: no KEV entry, no public exploitation evidence, and an EPSS of 0.00071 argue against treating this like an actively burning browser zero-day

Why not higher?

There is no evidence here of a sandbox escape, and that matters more than the scary phrase "arbitrary code execution" when you're triaging at scale. Without in-the-wild abuse or a public weaponized chain, this is not in the same bucket as a browser bug already being chained to full compromise.

Why not lower?

Do not overcorrect just because the first-stage impact is sandboxed. A remote, unauthenticated, web-delivered memory-corruption bug in Chrome is still prime initial-access material, and Chrome's enterprise exposure population is huge enough that even moderate exploit reliability can turn into real incident volume.

1. Force Chrome auto-update compliance — Use endpoint management or Chrome Enterprise policy to eliminate lagging builds and enforce rapid uptake of 149.0.7827.53+. For a HIGH verdict, get this control in place within 30 days if you do not already have enforced browser updating.
2. Disable or restrict WebRTC where the business can tolerate it — For kiosks, task-worker pools, admin jump boxes, and other low-media-use populations, reducing WebRTC availability trims reachable attack surface. Treat this as a compensating measure to deploy within 30 days on the highest-risk user groups first.
3. Put risky browsing behind isolation — Browser isolation, VDI browsing, or remote rendering for unmanaged destinations cuts exploit payoff by moving renderer compromise off the user endpoint. For a HIGH verdict, prioritize deployment to executives, admins, finance, and help desk users within 30 days.
4. Alert on browser spawn-and-breakout behavior — Tune EDR detections for chrome spawning unusual children, touching credential stores, or writing suspicious binaries. This does not stop the bug, but it improves chances of catching the second-stage breakout and should be tightened within 30 days.

Run this on the target endpoint or through your EDR/RMM remote script runner. Invoke it with python3 check_chrome_cve_2026_10903.py; no admin rights are usually needed, but Windows registry reads may work more consistently in a normal user context with local software inventory access.

#!/usr/bin/env python3
# Check Chrome version for CVE-2026-10903
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys

FIXED = (149, 0, 7827, 53)
VERSION_RE = re.compile(r'(\d+)\.(\d+)\.(\d+)\.(\d+)')


def parse_version(text):
    m = VERSION_RE.search(text or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_and_get_version(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True, timeout=10)
        return parse_version(p.stdout)
    except Exception:
        return None


def windows_candidates():
    candidates = []
    local = os.environ.get('LOCALAPPDATA', '')
    pf = os.environ.get('PROGRAMFILES', '')
    pf86 = os.environ.get('PROGRAMFILES(X86)', '')
    for path in [
        os.path.join(local, 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(pf, 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(pf86, 'Google', 'Chrome', 'Application', 'chrome.exe'),
    ]:
        if path and os.path.exists(path):
            candidates.append([path, '--version'])
    return candidates


def mac_candidates():
    candidates = []
    for path in [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
    ]:
        if os.path.exists(path):
            candidates.append([path, '--version'])
    return candidates


def linux_candidates():
    candidates = []
    for name in ['google-chrome', 'google-chrome-stable', '/opt/google/chrome/google-chrome']:
        resolved = shutil.which(name) if not name.startswith('/') else (name if os.path.exists(name) else None)
        if resolved:
            candidates.append([resolved, '--version'])
    return candidates


def get_version():
    system = platform.system().lower()
    if system == 'windows':
        cmds = windows_candidates()
    elif system == 'darwin':
        cmds = mac_candidates()
    else:
        cmds = linux_candidates()

    for cmd in cmds:
        ver = run_and_get_version(cmd)
        if ver:
            return ver, ' '.join(cmd)
    return None, None


def main():
    ver, source = get_version()
    if not ver:
        print('UNKNOWN: Google Chrome not found or version could not be determined')
        sys.exit(2)

    version_str = '.'.join(str(x) for x in ver)
    if ver >= FIXED:
        print(f'PATCHED: detected Chrome {version_str} via {source}; fixed threshold is 149.0.7827.53+')
        sys.exit(0)
    else:
        print(f'VULNERABLE: detected Chrome {version_str} via {source}; requires 149.0.7827.53+ (Linux) or 149.0.7827.53/54+ (Windows/macOS)')
        sys.exit(1)


if __name__ == '__main__':
    main()

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop (June 2, 2026)
2. Google Chrome Releases - Early Stable Update for Desktop (May 29, 2026)
3. Google Chrome Releases - Chrome for Android Update (June 2, 2026)
4. Chromium Security Page
5. Chromium issue 503422316
6. Chrome Enterprise and Education release notes
7. CISA Known Exploited Vulnerabilities Catalog
8. FIRST EPSS