CVE-2026-11050: Use after free in V8 in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in V8, the JavaScript engine embedded in Google Chrome prior to version 149.0.7827.53, allows a remote attacker to execute arbitrary code inside the browser sandbox. The vulnerability is reachable over the network and requires no authentication, though the victim must open a crafted HTML page, such as one delivered via a phishing link. Successful exploitation gives an attacker arbitrary code execution within the Chrome sandbox. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the victim's browser must be able to reach the attacker-controlled HTML page.

• AuthenticationNot required

  No account or credentials of any kind are needed; any unauthenticated user visiting the page is a valid target.

• Victim interactionRequired

  The victim must open a crafted HTML page, for example by clicking a link in a phishing email or being redirected by a malicious advertisement.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other hard-to-control environmental factors.

Blast Radius

• The attacker executes arbitrary code inside the Chrome renderer sandbox, gaining full control over the JavaScript execution context of the affected tab.
• Confidential data processed by the page, including session tokens, form inputs, and any secrets accessible to the page's origin, can be read directly.
• The attacker can modify page content and behavior, enabling credential theft, unauthorized transactions, or injection of further malicious payloads delivered to the user.
• While constrained to the sandbox, code execution in the renderer is commonly chained with a sandbox-escape bug to achieve full host-level compromise.