CVE-2026-11049: Use after free in Password Manager in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in the Password Manager component of Google Chrome (versions prior to 149.0.7827.53) allows a remote attacker to execute arbitrary code inside the Chrome sandbox. The attack is reachable over the network and requires no authentication, but does require the victim to visit a crafted HTML page. Successful exploitation grants the attacker arbitrary code execution within the browser sandbox, with high impact to confidentiality, integrity, and availability. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network by serving a crafted HTML page from a remote origin.

• AuthenticationNot required

  No credentials or account access are needed; the attacker requires only that the victim load a malicious page.

• Victim interactionRequired

  The victim must actively visit or be redirected to a crafted HTML page, making social engineering or a malicious link a prerequisite.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, special memory layout, or other environmental factors.

Blast Radius

• The attacker gains arbitrary code execution inside the Chrome renderer sandbox, enabling full control over the sandboxed process.
• Stored credentials and session data accessible to the Password Manager component are exposed to the attacker.
• The attacker can read, modify, or corrupt browser state and any data processed within the sandboxed context.
• The sandboxed process can be crashed or destabilized, disrupting browser availability for the victim.