CVE-2026-11059: Use after free in Blink in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in Blink, the rendering engine inside Google Chrome, affects all Chrome versions prior to 149.0.7827.53. The flaw is reachable over the network and requires no authentication, but a victim must open a crafted HTML page delivered by the attacker. Successful exploitation gives the attacker arbitrary code execution inside Chrome's renderer sandbox. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the victim's browser must be able to fetch the attacker-controlled HTML page.

• AuthenticationNot required

  No account or credential is needed on any system; the attacker only needs to serve a malicious page.

• Victim interactionRequired

  The victim must navigate to or be redirected to a crafted HTML page, making this a social-engineering or malicious-link scenario.

• Attack complexityDetail

  Exploit reliability is high and requires no special environmental conditions, race conditions, or memory-layout dependencies.

Blast Radius

• The attacker executes arbitrary code inside Chrome's renderer sandbox, gaining full control of the rendering process handling the victim's tab.
• Confidential data processed in the affected browsing context, including page content, stored credentials auto-filled by the browser, and session tokens, is readable by the attacker.
• The attacker can modify in-page data and trigger network requests from the victim's browser, enabling tampering with web application state.
• The affected renderer process can be crashed or destabilized, disrupting the victim's session and any background tasks tied to that process.