CVE-2026-11060: Use after free in Media in Google Chrome on Windows prior to 149

Synopsis

A use-after-free vulnerability in the Media component of Google Chrome on Windows allows a remote attacker to execute arbitrary code inside the browser sandbox. The vulnerability is reachable over the network with no authentication required, but the victim must visit a crafted HTML page. Successful exploitation gives the attacker code execution within the Chrome sandbox, which combined with a sandbox escape could lead to full system compromise. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the victim's browser must be able to reach an attacker-controlled or compromised web page.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated user who browses to the crafted page is exposed.

• Victim interactionRequired

  The victim must visit a crafted HTML page, making social engineering (phishing link, malicious ad, compromised site) a necessary part of the attack chain.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environment-specific conditions to trigger.

Blast Radius

• The attacker executes arbitrary code within the Chrome renderer sandbox on the victim's Windows host.
• Confidential data processed by the browser (session tokens, form input, cached credentials) is readable by the attacker's injected code.
• The attacker can modify or corrupt in-browser state, including DOM content and stored site data accessible to the renderer.
• A sandbox escape chained to this vulnerability would give the attacker full user-level access to the underlying Windows host.