Use after free in WebXR in Google Chrome prior to 149

CVE-2026-10982 is a use-after-free in Chrome's WebXR stack. On affected desktop builds, a malicious site can drive stale-object reuse and obtain arbitrary code execution inside a Chrome sandbox via crafted HTML/JavaScript. Affected versions are Chrome prior to 149.0.7827.53/54 on Windows and macOS, and prior to 149.0.7827.53 on Linux; downstream Chromium-based browsers inherit the issue until they pull the fix.

Google's HIGH/8.8 label is technically fair for memory corruption in a ubiquitous browser, but it overstates enterprise risk as a standalone patching signal. The decisive real-world brakes are: user interaction is required, the vulnerable surface is WebXR rather than baseline HTML parsing, and successful exploitation still lands inside Chrome's sandbox, which materially limits host compromise unless the attacker also has a second bug or settles for in-browser post-exploitation.

Why this verdict

• Downgrade from 8.8 baseline: vendor scoring prices in raw memory-corruption danger, but your fleet risk is materially reduced because the stated outcome is sandboxed-only code execution.
• Attacker position pressure: the chain is still unauthenticated remote, but it is post-lure and UI:R. That means the attacker needs the victim to browse and interact, which modern SWG, browser reputation, and user controls regularly disrupt.
• Surface-area pressure: this is WebXR, not core HTML parsing or ubiquitous image/media handling. In real enterprises, only a fraction of endpoints meaningfully expose the full XR path, especially where hardware/runtime support is absent or policy-constrained.
• Second-bug dependency: to get from 'sandboxed renderer code exec' to durable host compromise, the attacker typically needs a sandbox escape or separate privilege escalation. That missing link is a major downward adjustment.
• Threat-intel pressure is low: no KEV, no public exploitation evidence, and a very low EPSS mean there is no current attacker-behavior signal pushing this back up.

Why not higher?

Because the CVE does not by itself cross the most important enterprise boundary: the host OS. Chrome's sandbox and site/process isolation are not theoretical controls here; they are the exact reason a renderer-class memory corruption should not automatically inherit the urgency of a full remote host takeover. The WebXR-specific reachability constraint adds another real-world limiter.

Why not lower?

It is still a browser memory corruption bug in a massively deployed client application, and browsers remain an initial-access battleground. A malicious site plus user interaction is a realistic delivery model, and in-browser compromise can still expose sessions, tokens, and sensitive data even without a sandbox escape. So this is not backlog hygiene or ignore-grade noise.

1. Enforce browser auto-update — Make sure Chrome/Chromium auto-update is not disabled by policy and that stale channels are surfaced in endpoint management. For a MEDIUM verdict there is no mitigation SLA; use this control where patch lag exists before the 365-day remediation window.
2. Constrain risky browsing paths — Apply Secure Web Gateway, URL reputation, attachment detonation, and high-risk site isolation to reduce malicious-page delivery. There is no mitigation SLA for MEDIUM; treat this as an exposure reducer rather than a substitute for updating.
3. Limit unnecessary XR capability — Where business use does not require it, use enterprise browser policy or platform controls to reduce or disable XR-related access paths and hardware/runtime availability on managed endpoints. This directly attacks the narrowest part of the exploit chain and is worth doing on kiosks, shared workstations, and regulated user groups.
4. Prioritize high-risk cohorts first — If you cannot update the whole fleet at once, start with privileged users, finance, executives, developers, kiosks, and any endpoints with VR/AR hardware or Chromium laggards. There is no mitigation SLA for MEDIUM; this is a risk-based sequencing control ahead of the patch.

Run this on the target endpoint or through your EDR/remote execution tool with a local Python 3 interpreter. Invoke it as python3 chrome_cve_2026_10982_check.py; no admin rights are required. The script looks for common Chrome/Chromium desktop installs, reads the product version, and returns VULNERABLE, PATCHED, or UNKNOWN with exit codes 1, 0, and 2.

#!/usr/bin/env python3
# CVE-2026-10982 local exposure check for Chrome/Chromium desktop builds
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys
from pathlib import Path

FIX_WINDOWS_MAC = (149, 0, 7827, 54)  # .53/.54 released; .54 is safest floor for Win/Mac checks
FIX_LINUX = (149, 0, 7827, 53)
VERSION_RE = re.compile(r'(\d+)\.(\d+)\.(\d+)\.(\d+)')


def parse_version(text):
    if not text:
        return None
    m = VERSION_RE.search(text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        out = (p.stdout or '') + ' ' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def candidate_commands():
    system = platform.system()
    cmds = []

    if system == 'Windows':
        local = os.environ.get('LOCALAPPDATA', '')
        program_files = os.environ.get('ProgramFiles', '')
        program_files_x86 = os.environ.get('ProgramFiles(x86)', '')
        cmds.extend([
            [str(Path(local) / 'Google/Chrome/Application/chrome.exe'), '--version'],
            [str(Path(program_files) / 'Google/Chrome/Application/chrome.exe'), '--version'],
            [str(Path(program_files_x86) / 'Google/Chrome/Application/chrome.exe'), '--version'],
            [str(Path(program_files) / 'Chromium/Application/chrome.exe'), '--version'],
            [str(Path(program_files_x86) / 'Chromium/Application/chrome.exe'), '--version'],
        ])
    elif system == 'Darwin':
        cmds.extend([
            ['/Applications/Google Chrome.app/Contents/MacOS/Google Chrome', '--version'],
            ['/Applications/Chromium.app/Contents/MacOS/Chromium', '--version'],
            ['/Applications/Google Chrome Beta.app/Contents/MacOS/Google Chrome Beta', '--version'],
        ])
    else:
        for name in ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser', 'chrome']:
            path = shutil.which(name)
            if path:
                cmds.append([path, '--version'])

    return cmds


def compare(v1, v2):
    return (v1 > v2) - (v1 < v2)


def main():
    system = platform.system()
    fixed = FIX_WINDOWS_MAC if system in ('Windows', 'Darwin') else FIX_LINUX

    findings = []
    for cmd in candidate_commands():
        exe = cmd[0]
        if not os.path.exists(exe) and not shutil.which(exe):
            continue
        out = run_cmd(cmd)
        ver = parse_version(out)
        if ver:
            findings.append((exe, ver, out.strip()))

    if not findings:
        print('UNKNOWN: no supported Chrome/Chromium executable found')
        sys.exit(2)

    # Choose the highest discovered version as the effective browser version.
    findings.sort(key=lambda x: x[1], reverse=True)
    exe, ver, raw = findings[0]

    if compare(ver, fixed) >= 0:
        print(f'PATCHED: {exe} -> {ver[0]}.{ver[1]}.{ver[2]}.{ver[3]} (fixed floor {fixed[0]}.{fixed[1]}.{fixed[2]}.{fixed[3]})')
        sys.exit(0)
    else:
        print(f'VULNERABLE: {exe} -> {ver[0]}.{ver[1]}.{ver[2]}.{ver[3]} (fixed floor {fixed[0]}.{fixed[1]}.{fixed[2]}.{fixed[3]})')
        sys.exit(1)


if __name__ == '__main__':
    main()

Sources

1. Chrome Releases: Early Stable Update for Desktop (149.0.7827.53/.54)
2. Canadian Centre for Cyber Security advisory for Chrome versions prior to 149.0.7827.53/54
3. Chromium sandbox design documentation
4. Chromium Site Isolation design document
5. MDN: WebXR permissions and security
6. MDN: User activation security model
7. CISA Known Exploited Vulnerabilities Catalog
8. FIRST EPSS API documentation