CVE-2026-11009: Use after free in USB in Google Chrome on Windows prior to 149

Synopsis

Use-after-free in the USB component of Google Chrome on Windows (versions prior to 149.0.7827.53) allows a remote attacker to escape the browser sandbox via a crafted HTML page. The vulnerability is reachable over the network and requires no authentication, though the victim must visit a malicious page. Successful exploitation gives the attacker full read, write, and crash capability outside the browser sandbox, effectively yielding code execution on the host. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by luring the victim to a crafted HTML page, so the Chrome instance must be reachable in a browsing context exposed to attacker-controlled content.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated remote attacker can serve the malicious page.

• Victim interactionRequired

  The victim must open or be redirected to a crafted HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental prerequisites beyond the victim loading the page.

Blast Radius

• The attacker escapes the Chrome sandbox and gains code execution in the context of the browser process on the Windows host.
• With sandbox escape achieved, the attacker reads files, credentials, and session tokens accessible to the logged-in Windows user.
• The attacker can write or modify files on the host filesystem, including dropping persistent malware or altering application data.
• The attacker can crash or destabilize the host process, causing denial of service to the affected workload.