External risk intelligence

Chrome FedCM Use After Free Vulnerability Allows Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-103630

The vulnerability resides within a web browser's client-side component (FedCM). While the exploit mechanism involves a crafted HTML page, the attack surface is the browser software installed on an end-user device, not an internet-facing service, gateway, or network appliance. It is a client-side execution risk rather than a publicly reachable network service.

Use After Free

Google Chrome

before 154.0.8037.97

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability involves a flaw in the FedCM component of Google Chrome, which could allow a remote attacker to execute malicious code outside the browser's security sandbox. While the attack requires a user to visit a specially crafted web page, the potential for unauthorized code execution is a significant concern for any organization utilizing Chrome.

Flaw in Chrome allows malicious code execution.
Affects user browsing and could impact systems.
Confirm relevance and exposure within your environment.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into visiting a malicious web page, which then exploits a flaw in Chrome's FedCM feature. This could allow the attacker to execute their own code on the user's computer, potentially bypassing security restrictions.

Remote attackers visit crafted web pages.
Vulnerability in FedCM allows code execution.
Risk of arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A use-after-free vulnerability in the FedCM component of Google Chrome could allow a remote attacker to execute arbitrary code outside the sandbox. This could occur when a user visits a specially crafted HTML page, potentially impacting the integrity and confidentiality of data processed by the browser on the affected user's device.

Arbitrary code execution in the browser.
User visits a malicious HTML page.
Compromise of user's local data.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability, a use-after-free in FedCM, allows for arbitrary code execution outside the sandbox when a user visits a malicious HTML page, posing a critical risk. The primary responsibility for addressing this typically falls to teams managing end-user endpoints and browser deployments, often overlapping with platform or security operations. The first practical step involves identifying all Chrome instances, confirming user exposure, and prioritizing remediation based on device criticality.

Own by endpoint or browser management teams.
Verify user exposure to malicious sites.
Coordinate user-facing Chrome updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome's FedCM component?

FedCM (Federated Credential Management) is a browser API that allows users to sign in to websites using their existing accounts from third-party identity providers. It is designed to handle identity authentication securely within the browser without requiring third-party cookies. Chrome uses this component to manage these login interactions.

What does this CVE-2026-103630 vulnerability mean?

This is a Use After Free vulnerability (CWE-416). It occurs when a program continues to use a memory location after that memory has been freed or cleared. In this case, the flaw allows an attacker to manipulate that memory to run arbitrary code outside the browser's security sandbox, which is the protective wall meant to isolate websites from your computer's operating system.

How does an attacker trigger this Chrome vulnerability?

The vulnerability is triggered when a user visits a specifically crafted malicious HTML page that interacts with the flawed FedCM component. The bug does not trigger through normal, safe browsing activities. Simply having an outdated browser version installed does not execute the vulnerability; it requires the user to load a web page designed to exploit this specific memory error.

Is my organization at risk for CVE-2026-103630?

According to Halo Surface Signal, this vulnerability is categorized as having a low likelihood of traditional network-based exploitation because it resides on the client-side, not on an internet-facing server. The risk is localized to individual end-user devices. Organizations should focus on endpoints where users actively browse the web, as the threat depends on a user navigating to a malicious site.

What is the first step to fix this Chrome issue?

The primary response is to ensure that all Chrome installations are updated to version 154.0.8037.97 or later. Teams responsible for managing end-user devices should verify their current browser versions and coordinate a deployment of the latest stable update to patch the FedCM memory handling flaw across their environment.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.