CVE-2026-11074: Use after free in WebRTC in Google Chrome on Linux prior to 149

Synopsis

A use-after-free vulnerability in WebRTC affects Google Chrome on Linux prior to version 149.0.7827.53. The flaw is reachable over the network with no authentication required, but a victim must visit a crafted HTML page for exploitation to succeed. Successful exploitation gives the attacker arbitrary code execution on the victim's machine. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the victim's browser must be able to reach a remote attacker-controlled HTML page.

• AuthenticationNot required

  No account or credential of any kind is required; any unauthenticated remote attacker can serve the malicious page.

• Victim interactionRequired

  The victim must navigate to or be socially engineered into loading a crafted HTML page in an affected Chrome browser.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, memory-layout guessing, or other variable environmental factors.

Blast Radius

• Arbitrary code executes in the context of the Chrome renderer process on the victim's Linux host.
• Confidentiality is fully compromised: the attacker can read files, session tokens, and in-memory secrets accessible to the browser process.
• Integrity is fully compromised: the attacker can write, modify, or delete data accessible to the browser process.
• Availability is fully compromised: the attacker can crash or hang the browser process and potentially disrupt dependent services running under the same user account.