Use after free in Audio in Google Chrome on Windows prior to 149

CVE-2026-10933 is a use-after-free in Chrome Audio on Windows affecting builds before 149.0.7827.53. The key detail is the precondition in the advisory text: the attacker must have already compromised the renderer process. In plain English, this is not the bug that gets code running from a web page by itself; it is the bug that may help an attacker turn renderer code execution into a sandbox escape or broader browser compromise on Windows.

The vendor's HIGH 8.3 baseline is understandable if you score the memory corruption and post-exploit impact in isolation, but it overstates real enterprise urgency. The decisive friction is that this bug is post-initial-compromise within Chrome's exploit chain: no renderer compromise, no path. Add the low EPSS, no KEV listing, no public exploitation signal, and version-only detection, and this lands as MEDIUM for patch planning across a large fleet.

Why this verdict

• Major downward adjustment: requires prior renderer compromise — attacker position is not unauthenticated remote in practice; it implies a separate working browser exploit already exists.
• Exposure is broad but reachable population is narrow — Chrome is everywhere, but only systems where an attacker can first win the renderer and then land this exact version-specific second-stage bug are in scope.
• Telemetry says quiet, not hot — no KEV listing, very low EPSS, and no public exploitation notice from the release material keep this out of emergency lane.

Why not higher?

A higher rating would require a cleaner attack surface: standalone remote exploitability, active exploitation, or evidence that this reliably defeats the sandbox at scale. None of that is present in the supplied intel. The need for a preceding renderer compromise is compounding friction, not a minor caveat.

Why not lower?

It is still a memory-corruption bug in Chrome on Windows with potential sandbox-escape value once chained. In a browser exploit chain, second-stage bugs matter a lot, and the affected product is ubiquitous. That keeps it above LOW even without exploitation evidence.

1. Keep Chrome auto-update enforced — Use enterprise policy to prevent stale browser builds from lingering. For a MEDIUM verdict there is no noisgate mitigation SLA; fold this into normal browser governance and complete patching inside the 365-day remediation window, preferably in the next routine browser wave rather than waiting for long-tail cleanup.
2. Verify sandbox protections stay enabled — Audit for --no-sandbox, debugging exceptions, or unsupported wrapper tooling that weakens Chrome's containment model. There is no mitigation SLA for MEDIUM, but this hardening should be maintained continuously because it specifically raises attacker friction for renderer-to-broker pivots.
3. Maintain Site Isolation defaults — Do not relax Chrome Site Isolation on managed Windows endpoints. It does not fix the bug, but it limits what a compromised renderer can reach and should remain enforced as standard hardening while remediation proceeds within the 365-day window.
4. Hunt for Chrome crash clusters — Query EDR and reliability telemetry for repeated chrome.exe crashes, exploit prevention events, or suspicious relaunch loops on outdated builds. For MEDIUM, use this as targeted validation during the standard remediation cycle rather than as an emergency mitigation program.

Run this on the target Windows endpoint or through your remote management tool as a standard user; admin is not required. Example: powershell.exe -ExecutionPolicy Bypass -File .\check-chrome-cve-2026-10933.ps1 — it checks installed chrome.exe versions and returns VULNERABLE, PATCHED, or UNKNOWN.

# check-chrome-cve-2026-10933.ps1
# Verifies whether Google Chrome on Windows is older than 149.0.7827.53
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

param(
    [string]$MinimumVersion = '149.0.7827.53'
)

function Get-ChromePaths {
    $paths = New-Object System.Collections.Generic.List[string]

    $candidates = @(
        "$env:ProgramFiles\Google\Chrome\Application\chrome.exe",
        "$env:ProgramFiles(x86)\Google\Chrome\Application\chrome.exe",
        "$env:LOCALAPPDATA\Google\Chrome\Application\chrome.exe"
    )

    foreach ($p in $candidates) {
        if ($p -and (Test-Path $p)) { [void]$paths.Add($p) }
    }

    $regKeys = @(
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
        'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe'
    )

    foreach ($key in $regKeys) {
        try {
            $item = Get-ItemProperty -Path $key -ErrorAction Stop
            if ($item.'(default)' -and (Test-Path $item.'(default)')) {
                [void]$paths.Add($item.'(default)')
            }
            if ($item.Path) {
                $joined = Join-Path $item.Path 'chrome.exe'
                if (Test-Path $joined) { [void]$paths.Add($joined) }
            }
        } catch {}
    }

    return $paths | Sort-Object -Unique
}

function Get-FileVersionSafe([string]$Path) {
    try {
        $item = Get-Item $Path -ErrorAction Stop
        $ver = $item.VersionInfo.ProductVersion
        if (-not $ver) { $ver = $item.VersionInfo.FileVersion }
        if (-not $ver) { return $null }
        $ver = ($ver -split '\s+')[0]
        return [version]$ver
    } catch {
        return $null
    }
}

try {
    $min = [version]$MinimumVersion
} catch {
    Write-Output 'UNKNOWN: invalid minimum version format.'
    exit 2
}

$chromePaths = Get-ChromePaths
if (-not $chromePaths -or $chromePaths.Count -eq 0) {
    Write-Output 'UNKNOWN: chrome.exe not found in standard install locations.'
    exit 2
}

$results = @()
foreach ($path in $chromePaths) {
    $ver = Get-FileVersionSafe -Path $path
    if ($null -eq $ver) {
        $results += [pscustomobject]@{ Path = $path; Version = $null; State = 'UNKNOWN' }
    } elseif ($ver -lt $min) {
        $results += [pscustomobject]@{ Path = $path; Version = $ver.ToString(); State = 'VULNERABLE' }
    } else {
        $results += [pscustomobject]@{ Path = $path; Version = $ver.ToString(); State = 'PATCHED' }
    }
}

$results | ForEach-Object {
    if ($_.Version) {
        Write-Output ("{0} | {1} | {2}" -f $_.State, $_.Version, $_.Path)
    } else {
        Write-Output ("{0} | unknown-version | {1}" -f $_.State, $_.Path)
    }
}

if ($results.State -contains 'VULNERABLE') {
    Write-Output 'VULNERABLE'
    exit 1
}

if (($results | Where-Object { $_.State -eq 'PATCHED' }).Count -gt 0 -and -not ($results.State -contains 'UNKNOWN')) {
    Write-Output 'PATCHED'
    exit 0
}

if (($results | Where-Object { $_.State -eq 'PATCHED' }).Count -gt 0 -and -not ($results.State -contains 'VULNERABLE')) {
    Write-Output 'PATCHED'
    exit 0
}

Write-Output 'UNKNOWN'
exit 2

Sources

1. Chrome Releases: Early Stable Update for Desktop (149.0.7827.53/.54)
2. Chrome 149 release notes
3. Chromium sandbox FAQ
4. Chromium sandbox design for Windows
5. Chromium Site Isolation overview
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS API documentation