CVE-2026-11000: Use after free in Fonts in Google Chrome on Linux prior to 149

Synopsis

Use-after-free vulnerability in the Fonts subsystem of Google Chrome on Linux (versions prior to 149.0.7827.53) allows a remote attacker to execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The vulnerability is reachable over the network and requires no authentication, but does require the victim to visit a malicious page. Successful exploitation gives the attacker code execution within the Chrome sandbox, which may be chained with a sandbox-escape to fully compromise the host. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome on Linux.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the target Chrome instance must be reachable in the sense that the user can browse to an attacker-controlled URL.

• AuthenticationNot required

  No authentication or account is needed; any anonymous remote attacker can serve the crafted HTML page.

• Victim interactionRequired

  The victim must visit a crafted HTML page, making this a social-engineering vector that requires user action such as clicking a link or being redirected.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no race conditions, memory-layout guessing, or other environmental prerequisites beyond the victim loading the page.

Blast Radius

• The attacker gains arbitrary code execution inside the Chrome renderer sandbox on the affected Linux host.
• Confidentiality is fully compromised within the sandbox scope, exposing in-memory session tokens, cookies, and page content.
• Integrity is fully compromised within the sandbox scope, allowing modification of rendered content or in-process data structures.
• The renderer process can be crashed or forced into an unrecoverable state, disrupting browser availability for the affected user.