CVE-2026-11030: Use after free in Network in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in the Network component of Google Chrome prior to version 149.0.7827.53 allows a remote attacker to trigger heap corruption by sending malicious network traffic to a user's browser. The attack is reachable over the network, requires no authentication, but does require the victim to interact with attacker-controlled content. Successful exploitation gives the attacker full read, write, and crash capability within the browser process, enabling data theft, content tampering, or denial of service. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim's browser over the network, typically by serving malicious content from a remote host.

• AuthenticationNot required

  No account or credential is needed; the attacker does not authenticate to any service to deliver the exploit.

• Victim interactionRequired

  The victim must visit or interact with attacker-controlled content, such as clicking a link or loading a crafted page, for the exploit to trigger.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental prerequisites.

Blast Radius

• A successful attacker reads browser memory contents, including stored session tokens, autofill data, and credentials cached in the browser process.
• The attacker writes arbitrary data to heap memory, enabling modification of in-flight page content or browser state.
• The attacker can crash the Chrome renderer or browser process, causing an immediate denial of service for the affected user.
• Heap corruption at this level creates a realistic path to full renderer compromise, allowing the attacker to execute code within the browser's sandboxed process.