Use after free in Ozone in Google Chrome on Linux prior to 149

CVE-2026-10972 is a CWE-416 use-after-free in Chrome's Ozone platform layer on Linux. Per the advisory, Google Chrome on Linux before 149.0.7827.53 is affected, and a remote attacker can trigger the bug with a crafted HTML page to *potentially* achieve a sandbox escape. That matters because Ozone sits in the Linux windowing/display path, so this is not just tab crash territory; the stated impact crosses the browser sandbox boundary.

The vendor's 9.6 CRITICAL score is technically defensible in a vacuum because sandbox escape from web content is premium exploit real estate. In real enterprise deployments, though, the score overstates operational urgency: the bug is Linux-only, still needs user interaction to load attacker-controlled content, has no KEV listing, no public PoC/tooling, and an EPSS of 0.035% (11th percentile). That is still a real patch priority, just not a lights-on-fire emergency.

Why this verdict

• Started from vendor 9.6: sandbox escape from crafted web content is inherently dangerous and deserves a high baseline
• First downward adjustment — user interaction: the attacker must get a user onto malicious content (UI:R), which removes wormability and cuts opportunistic reach
• Second downward adjustment — Linux-only scope: this is not a whole-enterprise Chrome event unless you actually run a meaningful Linux desktop fleet
• Third downward adjustment — no active exploitation signal: no KEV entry, no public campaign references, and an EPSS of 0.035% / 11th percentile argue against emergency-tier pressure
• Fourth downward adjustment — no public weaponization: no public PoC or exploit tool lowers copycat risk and mass-abuse speed
• Why it stays HIGH: browser sandbox escape is still premium attacker payoff, and Chrome is widely used wherever Linux endpoints exist

Why not higher?

This is not an unauthenticated, server-side, internet-facing service flaw that an attacker can hit at scale without help from a user. The combination of Linux-only targeting, required browsing interaction, and no exploitation evidence strips away the conditions that usually justify a noisgate CRITICAL verdict.

Why not lower?

A browser sandbox escape is materially more dangerous than a renderer-only crash or a cosmetic client bug. If you have Linux endpoints browsing untrusted content, the bug can plausibly turn a web visit into endpoint compromise, so pushing it down to MEDIUM would understate the host impact.

1. Force the upgraded browser build — Push Chrome 149.0.7827.53 or later through your Linux package/channel controls and block older builds from lingering. For a HIGH verdict, deploy this control within 30 days while you complete full remediation.
2. Restrict untrusted browsing on Linux endpoints — Use secure web gateway policy, remote browser isolation, or VDI/jump-host patterns for high-risk browsing populations so commodity phishing pages do not reach local Chrome directly. This is the best temporary blast-radius reduction and should be in place within 30 days if patch rollout is staggered.
3. Hunt for outdated Linux Chrome installs — Inventory by package manager, EDR software catalog, or config management rather than waiting for network scanners. Your exposure metric is the number of Linux endpoints below 149.0.7827.53; complete that identification within 30 days.
4. Watch Linux browser crash and child-process telemetry — Alert on repeated Chrome crashes, suspicious descendants of the browser, and odd browser-to-shell/process execution patterns. It will not prevent exploitation, but it gives you a fighting chance to catch attempts while patching, and should be enabled within 30 days.

Run this on the target Linux endpoint or through your fleet agent/SSH automation. Invoke it as bash check_cve_2026_10972.sh with no special privileges required for version checks; example: ssh user@host 'bash -s' < check_cve_2026_10972.sh.

#!/usr/bin/env bash
# check_cve_2026_10972.sh
# Detects likely exposure to CVE-2026-10972 on Linux Chrome/Chromium installs.
# Outputs exactly one of: VULNERABLE, PATCHED, UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

FIXED_VERSION="149.0.7827.53"

ver_lt() {
  # returns 0 if $1 < $2
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" != "$2" ]
}

normalize_ver() {
  echo "$1" | grep -Eo '[0-9]+(\.[0-9]+){1,3}' | head -n1
}

get_bin_version() {
  local bin="$1"
  if command -v "$bin" >/dev/null 2>&1; then
    "$bin" --version 2>/dev/null | head -n1
    return 0
  fi
  return 1
}

CANDIDATES=(
  google-chrome
  google-chrome-stable
  chromium
  chromium-browser
  /opt/google/chrome/chrome
  /usr/bin/google-chrome
  /usr/bin/google-chrome-stable
  /usr/bin/chromium
  /usr/bin/chromium-browser
)

found_name=""
found_raw_ver=""
found_ver=""

for c in "${CANDIDATES[@]}"; do
  raw="$(get_bin_version "$c")" || continue
  ver="$(normalize_ver "$raw")"
  if [ -n "$ver" ]; then
    found_name="$c"
    found_raw_ver="$raw"
    found_ver="$ver"
    break
  fi
done

# Fallback to package manager queries if binary lookup failed
if [ -z "$found_ver" ]; then
  if command -v dpkg-query >/dev/null 2>&1; then
    for pkg in google-chrome-stable google-chrome chromium chromium-browser; do
      raw="$(dpkg-query -W -f='${Version}\n' "$pkg" 2>/dev/null | head -n1)"
      ver="$(normalize_ver "$raw")"
      if [ -n "$ver" ]; then
        found_name="$pkg"
        found_raw_ver="$raw"
        found_ver="$ver"
        break
      fi
    done
  fi
fi

if [ -z "$found_ver" ]; then
  if command -v rpm >/dev/null 2>&1; then
    for pkg in google-chrome-stable google-chrome chromium chromium-browser; do
      raw="$(rpm -q --qf '%{VERSION}-%{RELEASE}\n' "$pkg" 2>/dev/null | head -n1)"
      ver="$(normalize_ver "$raw")"
      if [ -n "$ver" ]; then
        found_name="$pkg"
        found_raw_ver="$raw"
        found_ver="$ver"
        break
      fi
    done
  fi
fi

if [ -z "$found_ver" ]; then
  echo "UNKNOWN"
  echo "No Chrome/Chromium version could be determined on this host." >&2
  exit 2
fi

# Advisory text is for Google Chrome on Linux. Chromium package builds may carry distro backports.
# If Chromium is detected, version-only checks may over-report risk; verify distro backport status.
case "$found_name" in
  chromium|chromium-browser|/usr/bin/chromium|/usr/bin/chromium-browser)
    if ver_lt "$found_ver" "$FIXED_VERSION"; then
      echo "UNKNOWN"
      echo "Detected Chromium-style build: $found_name ($found_raw_ver). Version is below upstream fixed version, but distro backports may already include the fix. Verify vendor package changelog." >&2
      exit 2
    else
      echo "PATCHED"
      echo "Detected Chromium-style build: $found_name ($found_raw_ver). Version is at or above upstream fixed version." >&2
      exit 0
    fi
    ;;
esac

if ver_lt "$found_ver" "$FIXED_VERSION"; then
  echo "VULNERABLE"
  echo "Detected $found_name version $found_ver, which is earlier than fixed version $FIXED_VERSION." >&2
  exit 1
else
  echo "PATCHED"
  echo "Detected $found_name version $found_ver, which is at or above fixed version $FIXED_VERSION." >&2
  exit 0
fi

Sources

1. GitHub Advisory Database - GHSA-fx2r-gfq7-r5p3
2. Chrome Releases - Stable Channel Update for Desktop (June 2, 2026)
3. Chromium issue 513006660
4. NVD entry for CVE-2026-10972
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS main page
7. FIRST EPSS API documentation
8. Chromium Security overview