CVE-2026-11068: Use after free in WebSockets in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability exists in the WebSockets implementation of Google Chrome prior to version 149.0.7827.53. The flaw is reachable over the network and requires no authentication, but a victim must visit a crafted HTML page for exploitation to succeed. Successful exploitation allows a remote attacker to execute arbitrary code inside the Chrome sandbox, with high impact to confidentiality, integrity, and availability. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the target Chrome instance must be able to reach an attacker-controlled or compromised web origin.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated remote attacker can serve the malicious page.

• Victim interactionRequired

  The victim must navigate to or be redirected to a crafted HTML page, making this a social-engineering or drive-by-delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no race condition, specific memory layout, or other environmental precondition to succeed.

Blast Radius

• A successful attacker executes arbitrary code inside the Chrome renderer sandbox, gaining a foothold for further browser-level exploitation.
• With code execution inside the sandbox, an attacker reads data accessible to the browser process, including session tokens, cookies, and page content from open tabs.
• The attacker can modify browser state or inject content into pages the victim is viewing, enabling credential theft or data tampering.
• The Chrome process can be crashed or made unresponsive, disrupting the victim's browsing session.