CVE-2026-11003: Use after free in WebRTC in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in the WebRTC component of Google Chrome prior to version 149.0.7827.53 allows a remote attacker to execute arbitrary code inside the browser sandbox. The bug is reachable over the network without any credentials, but the victim must visit a crafted HTML page. Successful exploitation gives the attacker code execution within the sandboxed renderer process. A patched-image rebuild at 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page hosted remotely.

• AuthenticationNot required

  No credentials or account are needed; the attacker requires only that the victim loads the malicious page.

• Victim interactionRequired

  The victim must actively visit or be redirected to a crafted HTML page, making social engineering or malicious ad delivery the likely delivery vector.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• The attacker executes arbitrary code within the Chrome renderer sandbox process on the victim's machine.
• High confidentiality impact means the attacker reads data accessible to the renderer, including page content, session tokens, and in-page credentials.
• High integrity impact means the attacker modifies data within the renderer context, including DOM state and any data the page writes to storage APIs.
• High availability impact means the attacker crashes or hangs the affected browser process, disrupting the user's session.