CVE-2026-11002: Use after free in Autofill in Google Chrome prior to 149

Synopsis

Use-after-free in the Autofill component of Google Chrome (versions prior to 149.0.7827.53) allows a remote attacker who has already compromised the renderer process to escape the browser sandbox via a crafted HTML page. The vulnerability is reachable over the network and requires no authentication, though it does require the victim to visit a malicious page and the attacker to have a pre-existing renderer compromise. Successful exploitation gives the attacker full confidentiality, integrity, and availability impact outside the sandbox boundary. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the target Chrome instance must be reachable or the user must browse to an attacker-controlled origin.

• AuthenticationNot required

  No credentials or account are needed; any unauthenticated user visiting the malicious page is a viable target.

• Victim interactionRequired

  The victim must open or be redirected to a specially crafted HTML page, making this dependent on a social-engineering or drive-by delivery step.

• Attack complexityDetail

  Attack complexity is rated High because the attacker must first achieve a renderer-process compromise before this use-after-free can be leveraged for sandbox escape, introducing a significant prerequisite condition.

Blast Radius

• Reads sensitive data from outside the Chrome sandbox, including stored credentials, cookies, and session tokens held by the browser process.
• Modifies browser state or files accessible to the browser process, enabling tampering with downloaded content or browser configuration.
• Crashes or destabilizes the browser process, causing a denial of service for the affected user session.
• Achieves code execution in the context of the browser process, bypassing the renderer sandbox and gaining a foothold at a higher privilege level on the host.