CVE-2026-11115: Use after free in Updater in Google Chrome on Windows prior to 149

Synopsis

A use-after-free vulnerability exists in the Updater component of Google Chrome on Windows in versions prior to 149.0.7827.53. The flaw is reachable locally by an authenticated low-privilege user who can place or interact with a malicious file, with no network access required. Successful exploitation grants the attacker OS-level privilege escalation, potentially giving full control over the underlying host. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network exposure is required to reach the vulnerable component.

• AuthenticationRequired

  Any low-privilege local account is sufficient; no administrative rights are needed to initiate the exploit.

• Victim interactionRequired

  A user on the target system must interact with a malicious file, introducing a social-engineering step for the attacker.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and does not depend on race conditions or specific environmental layout.

Blast Radius

• The attacker reads sensitive data accessible to the escalated OS-level privilege context, including credentials, session material, and protected files.
• The attacker modifies or overwrites OS-level files, registry entries, or security configurations on the Windows host.
• The attacker installs persistent malware or scheduled tasks under a higher-privilege account, surviving reboots and user logouts.
• The attacker disrupts or terminates protected system processes, causing service outages beyond the Chrome browser itself.