Use after free in Views in Google Chrome prior to 149

CVE-2026-10988 is a use-after-free in Chrome Views. The important qualifier is in the description itself: exploitation requires an attacker who has already compromised the renderer process. Affected builds are Chrome versions before 149.0.7827.53; Google pushed 149.0.7827.53/.54 to the Early Stable channel for Windows and Mac on 2026-05-29, and the same version number appeared on Beta for Windows, Mac, and Linux that day.

Google's HIGH 8.8 baseline is defensible if you score the bug as part of a browser exploit chain, because a renderer-to-browser escape can turn a web bug into host compromise. But for patch triage on a 10,000-endpoint fleet, this is not equivalent to a one-click unauthenticated remote RCE. The attacker must first win a separate renderer compromise, then successfully drive a fragile second-stage memory-corruption path, and modern Chrome defenses like sandboxing and Site Isolation exist specifically to make that chain harder.

Why this verdict

• Major downgrade: requires prior renderer compromise — this is post-initial-access inside the browser, not a standalone drive-by host compromise.
• Reachable population is narrower than CVSS implies — every internet user can be lured to a page, but only victims for whom an attacker also has a working first-stage renderer exploit can reach this bug.
• Chrome's own architecture is designed for this exact threat model — sandboxing and Site Isolation reduce blast radius and raise exploit engineering cost even when the renderer is hostile.
• No exploitation signal — no KEV entry, no public exploit repo, and an extremely low EPSS remove the strongest urgency amplifiers.
• Still not ignorable — if chained with a renderer bug, a browser-process escape can convert a browser foothold into meaningful endpoint compromise.

Why not higher?

A higher rating would fit only if this were independently reachable from the web, had strong public exploit evidence, or were already in active campaigns. None of those conditions were present in the reviewed sources. The prerequisite of prior renderer compromise compounds with the lack of public tradecraft, pulling this well below emergency-tier browser response.

Why not lower?

This is still a Chrome sandbox-boundary problem, not a cosmetic crash. Chrome is ubiquitous, and second-stage browser escapes are exactly the kind of bugs high-end operators chain when they do have a renderer entry. So while the fleet-level urgency is lower than vendor HIGH, dropping it to LOW or IGNORE would understate the potential impact on targeted users and privileged browsing sessions.

1. Verify browser auto-update health — Confirm your fleet is actually ingesting Chrome updates and relaunching into patched builds. For a MEDIUM verdict there is no mitigation SLA — fold this into the next normal browser operations cycle while ensuring endpoints do not remain stranded on old versions indefinitely.
2. Preserve sandbox and Site Isolation defaults — Do not weaken Chrome with flags, legacy compatibility settings, or unmanaged variants that disable or erode renderer containment. This matters because the bug only pays off after renderer compromise; keeping containment intact reduces the chance the chain lands useful impact. For MEDIUM, there is no mitigation SLA — keep this as hardening hygiene, not emergency change work.
3. Prioritize high-risk user rings — Move admins, developers, executives, researchers, and users handling sensitive SaaS sessions onto the latest Chrome build first. These populations get the worst outcome if a renderer exploit is ever paired with this bug. For MEDIUM, there is no mitigation SLA — use your next scheduled browser ring promotion.
4. Watch for browser crash anomalies — Use EDR, crash telemetry, or helpdesk trend data to spot repeated Chrome crashes or suspicious browser child-process behavior that could indicate exploit testing. This is useful because version scanners cannot tell you whether anyone is attempting the second-stage chain. For MEDIUM, there is no mitigation SLA — add it to routine hunting and monitoring.

Run this on the target endpoint or through your software-distribution/remote-exec tooling. Invoke it as python3 chrome_cve_2026_10988_check.py on macOS/Linux or py chrome_cve_2026_10988_check.py on Windows; standard user rights are usually enough because it only reads local version metadata from common Chrome install locations.

#!/usr/bin/env python3
# CVE-2026-10988 Chrome version check
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import os
import platform
import re
import subprocess
import sys
from pathlib import Path

FIXED = (149, 0, 7827, 53)


def parse_version(text):
    if not text:
        return None
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_version(a, b):
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        r = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        out = (r.stdout or '') + '\n' + (r.stderr or '')
        return out.strip()
    except Exception:
        return ''


def windows_candidates():
    roots = [
        os.environ.get('ProgramFiles', r'C:\Program Files'),
        os.environ.get('ProgramFiles(x86)', r'C:\Program Files (x86)'),
        os.environ.get('LocalAppData', ''),
    ]
    rels = [
        r'Google\Chrome\Application\chrome.exe',
        r'Google\Chrome Beta\Application\chrome.exe',
        r'Google\Chrome Dev\Application\chrome.exe',
    ]
    out = []
    for root in roots:
        if not root:
            continue
        for rel in rels:
            p = Path(root) / rel
            if p.exists():
                out.append(p)
    return out


def mac_candidates():
    return [
        Path('/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
        Path('/Applications/Google Chrome Beta.app/Contents/MacOS/Google Chrome Beta'),
        Path('/Applications/Google Chrome Dev.app/Contents/MacOS/Google Chrome Dev'),
        Path.home() / 'Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
    ]


def linux_candidates():
    names = ['google-chrome', 'google-chrome-stable', 'google-chrome-beta', 'google-chrome-unstable', 'chromium', 'chromium-browser']
    paths = []
    for name in names:
        out = run_cmd(['which', name])
        p = out.splitlines()[0].strip() if out else ''
        if p and Path(p).exists():
            paths.append(Path(p))
    return paths


def get_version_from_binary(path_obj):
    p = str(path_obj)
    if platform.system() == 'Windows':
        ps = [
            'powershell', '-NoProfile', '-Command',
            f"(Get-Item '{p.replace("'", "''")}').VersionInfo.ProductVersion"
        ]
        return parse_version(run_cmd(ps))
    else:
        return parse_version(run_cmd([p, '--version']))


def main():
    system = platform.system()
    if system == 'Windows':
        candidates = windows_candidates()
    elif system == 'Darwin':
        candidates = [p for p in mac_candidates() if p.exists()]
    else:
        candidates = linux_candidates()

    findings = []
    for c in candidates:
        ver = get_version_from_binary(c)
        findings.append((str(c), ver))

    findings = [(p, v) for p, v in findings if v is not None]

    if not findings:
        print('UNKNOWN: Chrome not found in common locations or version could not be parsed')
        sys.exit(2)

    vulnerable = []
    patched = []
    for path, ver in findings:
        if cmp_version(ver, FIXED) < 0:
            vulnerable.append((path, ver))
        else:
            patched.append((path, ver))

    if vulnerable:
        print('VULNERABLE')
        for path, ver in vulnerable:
            print(f'  {path} -> {".".join(map(str, ver))} < {".".join(map(str, FIXED))}')
        if patched:
            print('  Note: patched installations were also found:')
            for path, ver in patched:
                print(f'    {path} -> {".".join(map(str, ver))}')
        sys.exit(1)

    print('PATCHED')
    for path, ver in patched:
        print(f'  {path} -> {".".join(map(str, ver))} >= {".".join(map(str, FIXED))}')
    sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Chrome Releases: Early Stable Update for Desktop (149.0.7827.53/.54)
2. Chrome Releases archive for May 2026
3. Chromium Site Isolation overview
4. Chromium Site Isolation design document
5. Chromium Memory safety
6. Chromium Secure Architecture
7. CISA Known Exploited Vulnerabilities Catalog
8. FIRST EPSS API documentation