CVE-2026-11028: Use after free in Media in Google Chrome on Linux and ChromeOS prior to 149

Synopsis

A use-after-free vulnerability affects the Media component of Google Chrome on Linux and ChromeOS in versions prior to 149.0.7827.53. The flaw is reachable over the network and requires no authentication, but the attacker must trick a user into visiting a crafted HTML page and must have already compromised the renderer process. Successful exploitation enables arbitrary code execution inside the browser sandbox. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network by serving or linking to a crafted HTML page hosted remotely.

• AuthenticationNot required

  No account credentials or prior authentication to the target system are needed to deliver the malicious page.

• Victim interactionRequired

  The victim must visit a crafted HTML page, requiring the attacker to use social engineering or a malicious link to direct them there.

• Attack complexityDetail

  Exploit reliability is high and no special environmental conditions are required beyond the prerequisite renderer compromise; however, achieving that renderer compromise is itself a significant precondition.

Blast Radius

• An attacker gains arbitrary code execution inside the Chrome sandbox on the affected Linux or ChromeOS host.
• With sandbox-level code execution, the attacker can read browser memory, including session tokens, cookies, and page content from open tabs.
• The attacker can tamper with in-process data, injecting content or manipulating network requests made by the compromised renderer.
• Abuse of the freed memory region can also crash the affected Chrome process, disrupting the user's session.