CVE-2026-11054: Use after free in WebRTC in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in the WebRTC component of Google Chrome prior to version 149.0.7827.53 allows a remote attacker to execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The flaw is reachable over the network and requires no authentication, only a single user interaction (visiting the malicious page). Successful exploitation gives the attacker arbitrary code execution within the Chrome sandbox, with high impact to confidentiality, integrity, and availability. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the target must be able to reach (or be directed to) an attacker-controlled web server.

• AuthenticationNot required

  No account or credential is needed; any anonymous user can be targeted.

• Victim interactionRequired

  The victim must visit a crafted HTML page, making this a social-engineering-dependent exploit (for example, via a phishing link or malicious advertisement).

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• The attacker executes arbitrary code inside the Chrome renderer sandbox, gaining full control of the sandboxed process.
• With renderer-level code execution, the attacker can read any data the page has access to, including session tokens, form inputs, and cookies.
• The attacker can modify page state and browser-mediated storage, potentially tampering with data the victim submits or receives.
• The renderer process can be crashed or made unresponsive, disrupting the user's browsing session.