CVE-2026-11114: Use after free in Device Trust in Google Chrome on Mac prior to 149

Synopsis

A use-after-free vulnerability in the Device Trust component of Google Chrome on macOS affects all Chrome versions prior to 149.0.7827.53. The flaw is reachable over the network without authentication, but requires the attacker to have already compromised the renderer process and to lure a user into visiting a crafted HTML page. Successful exploitation enables a sandbox escape, granting the attacker capabilities beyond the Chrome renderer sandbox including potential full code execution on the host. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the target Chrome instance must be reachable or the user must browse to an attacker-controlled remote resource.

• AuthenticationNot required

  No account or credential is needed; the attack is initiated by a user visiting a specially crafted page served by the attacker.

• Victim interactionRequired

  A user must open or be redirected to the attacker-crafted HTML page, making social engineering or a malicious ad or link a prerequisite.

• Attack complexityDetail

  Attack complexity is rated Low, meaning the exploit is reliable and does not depend on race conditions or specific memory layout prerequisites beyond the renderer-compromise precondition.

Blast Radius

• A successful attacker escapes the Chrome renderer sandbox on macOS, gaining execution context outside Chrome's process isolation boundary.
• With sandbox escape achieved, the attacker reads files and credentials accessible to the user account running Chrome, including keychain-adjacent data on macOS.
• The attacker writes or modifies files on the host filesystem within the permissions of the compromised user account.
• The attacker disrupts or terminates host-level processes accessible to that user, potentially causing application or service failures on the affected machine.