CVE-2026-10931 is an use after free in the FileSystem component of Google Chrome before 149.0.7827.53. NVD scores it 9.6 critical while Chromium rates it High. The record says a remote attacker could potentially escape the sandbox through a crafted HTML page. Update Chrome to 149.0.7827.53 or later.
What's affected
Google Chrome on Windows, Mac and Linux before 149.0.7827.53. Per the Chrome stable channel post, the fixed build is 149.0.7827.53 on Linux and 149.0.7827.53 or .54 on Windows and Mac.
Other Chromium based browsers take the fix on their own schedule, so check each vendor's release notes for the matching Chromium version before you assume you are covered.
How to check if you're exposed
Open chrome://settings/help and compare the version number with the fixed build above. The page also triggers the update check. On Linux you can read the installed version from a terminal:
google-chrome --version
For managed fleets, use your browser management console or endpoint inventory to list Chrome versions and filter for anything older than the fixed build. Chrome only applies an update after a relaunch, so a machine that has downloaded the update can still be running the old build.
What to do now
- Update Chrome to 149.0.7827.53 or later and relaunch the browser.
- Report browsers that have not relaunched in more than a few days, since they still run the old code.
- Check Chromium based browsers and embedded Chromium in desktop apps, and update them when the vendor ships the matching release.
- Keep automatic updates on, and avoid pinning old Chrome builds in managed images.
Why it matters
The weakness class is CWE-416. A use after free happens when code keeps using memory after it has been released. If an attacker can shape what lands in that memory, the program may act on data they control.
The record describes it as reachable from a crafted web page, with no prior foothold required. Browser bugs of this kind matter because the sandbox and site isolation are the main containment layers between a hostile web page and the rest of the machine. When one of them has a hole, the next bug in the chain gets more room to work.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and no advisory I read says it is exploited. Treat it as a routine but urgent update.
Quick check
Do I need to do anything besides update?
No special mitigation is described. Update and relaunch Chrome, then confirm the version on the About page.
What is a use after free in plain terms?
It is a memory safety bug where a program reads or writes memory after giving it back. The result can be a crash or, in a worse case, attacker influenced behavior.
Sources
Last reviewed: 19 October 2026.
