Use after free in WebRTC in Google Chrome prior to 149

CVE-2026-10939 is a use-after-free in Chrome's WebRTC stack that affects Google Chrome builds before 149.0.7827.53. Google shipped the fix in the Chrome 149 stable release on June 2, 2026, with fixed builds listed as 149.0.7827.53 for Linux and 149.0.7827.53/54 for Windows and macOS. The bug is reachable from a malicious web page, so the trigger surface is broad: get a user onto attacker-controlled content and let the browser do the rest.

Google's HIGH / 8.8 label is technically fair for the memory-corruption primitive, but it overstates the likely enterprise outcome if you read it as 'one-click endpoint compromise.' The decisive reality check is that the stated impact is arbitrary code execution inside Chrome's sandbox; that means meaningful host compromise usually needs a second bug or some separate escape path. This stays important because Chrome is everywhere and the bug is remote, but it is not the same as a clean unauthenticated server-side RCE.

Why this verdict

• Start at vendor 8.8: remote, no-privilege browser memory corruption on a massively deployed client is a legitimately dangerous baseline.
• Subtract for UI:R and lure dependence: the attacker still needs the victim to render hostile content, which narrows reach compared with zero-click or server-side bugs.
• Subtract for sandbox containment: the documented impact is renderer-sandbox code execution, so most meaningful endpoint outcomes require a second vulnerability or trust-boundary failure.
• Subtract for weak threat signal: supplied EPSS 0.00071, no KEV listing, and no public in-the-wild note from Google all argue against emergency-grade prioritization.
• Add back for exposure scale: unlike a niche app, Chrome is everywhere; even a partially constrained bug has broad fleet reach across a 10,000-host estate.

Why not higher?

This is not a clean one-bug workstation takeover in the way admins often hear 'RCE' and mentally model it. The need for user interaction plus the fact that execution lands inside the sandbox are two real, compounding brakes on enterprise blast radius.

Why not lower?

It is still a remote browser memory-corruption bug in one of the most deployed applications in the enterprise. No authentication is needed, complexity is low once the victim loads content, and the reachable population is far larger than for most authenticated or internal-only vulnerabilities.

1. Force Chrome relaunch compliance — Use enterprise browser management, endpoint management, or logon scripts to make sure the fixed build is actually running, not merely downloaded. For a HIGH verdict, deploy this compensating measure within 30 days; Chrome auto-update without relaunch enforcement leaves stale vulnerable renderer processes on a large fleet.
2. Prefer browser isolation for high-risk browsing — Route unmanaged internet browsing, contractor access, and high-risk user groups through remote/browser isolation where available. This reduces the value of a renderer compromise while you drive the fleet to the fixed build; for a HIGH verdict, put this in place or tighten policy within 30 days for the riskiest cohorts.
3. Constrain WebRTC where business allows — If your environment does not rely heavily on browser-based voice/video apps, reduce or disable WebRTC exposure using enterprise Chrome policy for selected populations. That is a practical blast-radius reducer for this specific component and should be applied within 30 days where operationally safe.
4. Harden second-stage containment — Make sure EDR exploit protection, application control, child-process restrictions, and browser-to-OS detection rules are tuned, because the attacker needs a follow-on stage to convert this into a host compromise. For a HIGH verdict, validate those controls within 30 days on standard workstation images.

Run this on the target endpoint or through your EDR/remote execution platform. Invoke it with python3 check_chrome_cve_2026_10939.py on Linux/macOS or py check_chrome_cve_2026_10939.py on Windows; no admin privileges are required as long as the Chrome binary is readable in standard install paths.

#!/usr/bin/env python3
# Check Google Chrome version for CVE-2026-10939
# Outputs: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys

FIXED = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_str(v):
    return '.'.join(str(x) for x in v)


def run_version(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        out = (p.stdout or '') + ' ' + (p.stderr or '')
        return parse_version(out)
    except Exception:
        return None


def windows_candidates():
    paths = []
    env_roots = [
        os.environ.get('ProgramFiles'),
        os.environ.get('ProgramFiles(x86)'),
        os.environ.get('LocalAppData')
    ]
    suffixes = [
        r'Google\Chrome\Application\chrome.exe',
        r'Chromium\Application\chrome.exe'
    ]
    for root in env_roots:
        if not root:
            continue
        for suffix in suffixes:
            p = os.path.join(root, *suffix.split('\\'))
            if os.path.exists(p):
                paths.append(p)
    return paths


def mac_candidates():
    return [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome')
    ]


def linux_candidates():
    cmds = []
    for name in ['google-chrome', 'google-chrome-stable', 'chrome']:
        p = shutil.which(name)
        if p:
            cmds.append(p)
    for p in ['/opt/google/chrome/chrome', '/usr/bin/google-chrome', '/usr/bin/google-chrome-stable']:
        if os.path.exists(p) and p not in cmds:
            cmds.append(p)
    return cmds


def collect_versions():
    system = platform.system().lower()
    found = []

    if 'windows' in system:
        for path in windows_candidates():
            v = run_version([path, '--version'])
            if v:
                found.append((path, v))
    elif 'darwin' in system:
        for path in mac_candidates():
            if os.path.exists(path):
                v = run_version([path, '--version'])
                if v:
                    found.append((path, v))
    else:
        for path in linux_candidates():
            v = run_version([path, '--version'])
            if v:
                found.append((path, v))

    return found


def main():
    found = collect_versions()
    if not found:
        print('UNKNOWN: Google Chrome not found in standard locations or version unreadable')
        sys.exit(2)

    vulnerable = []
    patched = []
    for path, ver in found:
        if ver < FIXED:
            vulnerable.append((path, ver))
        else:
            patched.append((path, ver))

    if vulnerable:
        details = '; '.join(f'{path}={version_str(ver)}' for path, ver in vulnerable)
        print(f'VULNERABLE: fixed version is {version_str(FIXED)}; found {details}')
        sys.exit(1)

    details = '; '.join(f'{path}={version_str(ver)}' for path, ver in patched)
    print(f'PATCHED: fixed version is {version_str(FIXED)}; found {details}')
    sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Google Chrome stable desktop release 149
2. Google Chrome early stable desktop release 149.0.7827.53/54
3. Google Chrome beta desktop update 149.0.7827.53
4. Chromium sandbox design documentation
5. Chromium sandbox FAQ
6. CISA Known Exploited Vulnerabilities catalog
7. FIRST EPSS overview
8. Chromium issue tracker entry 503502607