CVE-2026-11094: Use after free in Codecs in Google Chrome on Windows prior to 149

Synopsis

A use-after-free vulnerability exists in the Codecs component of Google Chrome on Windows in versions prior to 149.0.7827.53. The flaw is reachable over the network with no authentication required, but the attacker must convince a user to visit a crafted HTML page and must have already compromised the Chrome renderer process. Successful exploitation enables a sandbox escape, giving the attacker code execution outside the browser sandbox with full confidentiality, integrity, and availability impact on the host. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page hosted on an attacker-controlled or compromised site.

• AuthenticationNot required

  No account credentials or prior authentication are needed; any user who visits the malicious page is a valid target.

• Victim interactionRequired

  The victim must actively open or be redirected to the crafted HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is rated Low, meaning the exploit is reliable and does not depend on race conditions or specific memory layout; however, a prerequisite renderer compromise is required before the sandbox escape is possible.

Blast Radius

• An attacker who triggers the sandbox escape gains code execution outside the Chrome sandbox on the affected Windows host.
• With sandbox containment broken, the attacker can read files, credentials, and session tokens accessible to the browser process user account.
• The attacker can write or modify files on the host, install persistent malware, or alter application data.
• The attacker can crash or terminate the browser process and, depending on post-exploitation steps, disrupt other host services.