CVE-2026-11116: Use after free in Chromoting in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in the Chromoting component of Google Chrome (versions prior to 149.0.7827.53) allows a remote attacker to execute arbitrary code by sending malicious network traffic. The vulnerability is reachable over the network, requires no authentication, but does require the victim to interact with crafted content. Successful exploitation gives the attacker full code execution in the context of the browser process, enabling data theft, tampering, and service disruption. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim's browser over the network by delivering malicious network traffic to the Chromoting component.

• AuthenticationNot required

  No account or credentials are needed; the attacker requires no prior authentication to trigger the vulnerability.

• Victim interactionRequired

  The victim must interact with attacker-controlled content (for example, visiting a malicious page or opening crafted remote-desktop session data) to trigger the use-after-free.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions or specific memory-layout preconditions.

Blast Radius

• A successful attacker executes arbitrary code in the context of the Chrome browser process on the victim's machine.
• The attacker reads browser-stored data including session tokens, saved passwords, and cookies for sites the victim is authenticated to.
• The attacker modifies local browser state, injecting content or altering stored credentials and browsing data.
• The attacker can crash or destabilize the browser process, causing denial of service for the affected user session.