CVE-2026-11071: Use after free in Base in Google Chrome on Linux prior to 149

Synopsis

Use-after-free vulnerability in the Base component of Google Chrome on Linux (versions prior to 149.0.7827.53) allows a remote attacker who has already compromised the renderer process to read arbitrary regions of process memory by serving a crafted HTML page. The attack is reachable over the network and requires no authentication, though it does require the victim to visit a malicious page. Successful exploitation exposes sensitive data held in memory, including session tokens, credentials, or other in-process secrets. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page, so the Chrome instance must be reachable or browsing to an attacker-controlled origin.

• AuthenticationNot required

  No account or credential on the target system is needed; any unauthenticated remote attacker can serve the malicious page.

• Victim interactionRequired

  The victim must open or be redirected to a crafted HTML page in the affected Chrome browser, making this a social-engineering or malicious-ad delivery scenario.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors, though it does require a prior renderer compromise as a precondition.

Blast Radius

• Reads arbitrary regions of the renderer process memory, exposing in-process secrets such as session tokens, cached credentials, and decrypted page content.
• Exfiltrates any sensitive data the compromised renderer currently holds, including form autofill values and authentication cookies loaded in active tabs.
• The CVSS integrity and availability scores are both High, so depending on the attacker's follow-on capability, in-memory data structures can be corrupted and the affected process can be crashed.