CVE-2026-11042: Use after free in Views in Google Chrome prior to 149

Synopsis

Use-after-free in the Views component of Google Chrome prior to version 149.0.7827.53 allows a remote attacker to corrupt heap memory. The vulnerability is reachable over the network and requires no authentication, but does require the attacker to convince a target user to perform specific UI gestures on a crafted HTML page. Successful exploitation gives the attacker read access to sensitive memory, the ability to tamper with process memory, and the ability to crash or destabilize the browser process, with potential for arbitrary code execution via heap corruption. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the target's browser must be able to reach attacker-controlled content.

• AuthenticationNot required

  No account or credential is needed; the attack is launched against any user who visits the malicious page.

• Victim interactionRequired

  The attacker must convince the target user to perform specific UI gestures on the crafted page, making this a social-engineering-dependent exploit path.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit does not depend on race conditions or specific memory layouts and is reliable once the victim performs the required gestures.

Blast Radius

• Reads process memory contents, which may include session tokens, credentials, or other sensitive data held in the browser's heap.
• Modifies in-process memory, enabling the attacker to tamper with page state, bypass security checks, or corrupt data structures.
• Crashes the browser process or renders it unstable, causing denial of service for the affected user session.
• Heap corruption from a use-after-free at this severity level is a recognized stepping stone to arbitrary code execution within the browser process.