External risk intelligence

Chrome Glic Use After Free Sandbox Escape

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-10990

This vulnerability exists within the client-side browser renderer process. Exploitation requires a user to navigate to a crafted HTML page, making it a client-side interaction rather than an internet-facing service, API, or gateway exposed for remote connection.

Use After Free

Google Chrome

before 149.0.7827.53

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A use-after-free vulnerability in Google Chrome's Glic component could allow an attacker to escape the browser's sandbox if a user visits a malicious webpage. While the potential impact is severe, exploitation requires user interaction and is limited to the client-side browser process. The primary concern is to confirm if your organization utilizes the affected component.

A browser flaw could let attackers break out of the sandbox.
User interaction needed; affects client-side browser process.
Confirm relevance and exposure of the affected component.

Attack Path

How an attacker could exploit the issue

An attacker could initiate an attack by luring a user to a malicious website. This website would contain a specially crafted HTML page designed to trigger a use-after-free vulnerability within the Glic component of Google Chrome. If successful, this could allow the attacker to break out of the browser's sandbox, potentially leading to broader system compromise.

Requires a compromised renderer process.
Triggered by a crafted HTML page.
Risk of sandbox escape.

Live Threat

Current exploitation, exposure, and threat context

A use-after-free vulnerability in the Glic component of Google Chrome, when exploited from a compromised renderer process, could allow a remote attacker to escape the browser's sandbox. This would require the user to visit a specially crafted HTML page.

Sandbox escape and system access.
Visiting a malicious web page.
Potential compromise of user data.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Google Chrome, a widely used browser. The primary responsibility for addressing this lies with teams managing end-user computing environments, such as IT operations or desktop support, in conjunction with security teams responsible for endpoint protection and vulnerability management. The immediate first step is to identify all deployed instances of the affected Chrome version, confirm user impact, and coordinate the update process.

Ownership: Desktop support and security teams.
Verify first: Identify affected Chrome versions.
Action: Plan coordinated user updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Glic component in Google Chrome?

Glic is a specific internal component within the Google Chrome browser architecture. It handles distinct processing tasks that, when functioning normally, help the browser render content and manage user sessions safely. This CVE relates to how that component manages memory, which is a common area for security research in modern web browsers.

What does a use-after-free vulnerability mean in CVE-2026-10990?

This vulnerability, classified as CWE-416, occurs when software continues to use a memory address after it has been cleared or released. If an attacker can manipulate this process, they may be able to force the browser to execute unintended code. In this specific case, the weakness could allow a malicious actor to escape the security boundaries, known as a sandbox, that normally isolate the browser from the rest of your computer.

How is this Chrome vulnerability triggered?

An attacker must first successfully compromise the browser's renderer process and then lure a user to a specially crafted HTML page. The vulnerability is not triggered simply by having the browser installed or running in the background. It specifically requires a user to actively navigate to a malicious website that contains the code designed to exploit the memory management flaw in the Glic component.

Is this CVE a risk for my internet-facing servers?

According to Halo Surface Signal, this is highly unlikely. Because the vulnerability exists within the client-side browser renderer, it is not a traditional internet-facing service or API that can be scanned for remotely. It is a client-side issue that depends on human interaction, meaning your focus should be on end-user devices rather than server-side infrastructure.

What should I do if I use Google Chrome?

The primary response is to ensure your Chrome instances are updated to version 149.0.7827.53 or later. IT and desktop support teams should focus on inventorying managed devices to identify any installations running older, vulnerable versions. Once identified, coordinate a standard update deployment to ensure users are protected by the latest security patches provided by the vendor.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.