CVE-2026-11117: Use after free in Views in Google Chrome on Windows prior to 149

Synopsis

A use-after-free vulnerability exists in the Views component of Google Chrome on Windows in versions prior to 149.0.7827.53. The flaw is reachable over the network and requires no authentication, but does require the victim to visit a crafted HTML page. Successful exploitation gives an attacker remote code execution on the victim's machine. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a remote crafted HTML page, so the service must be reachable from the internet or an accessible network.

• AuthenticationNot required

  No account or credential is needed on the target system; the attack is launched entirely through the browser by an unauthenticated remote attacker.

• Victim interactionRequired

  The victim must visit a crafted HTML page, meaning the attacker must persuade them to click a link or otherwise navigate to attacker-controlled content.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, special memory layout, or other environmental factors.

Blast Radius

• A successful attacker gains arbitrary code execution in the context of the Chrome renderer process on the victim's Windows host.
• With code execution, the attacker can read files and stored browser data accessible to the running Chrome process, including session cookies and saved credentials.
• The attacker can write or modify files on the local filesystem within the permissions of the browser process user.
• The attacker can crash or destabilize the browser process, disrupting the victim's session.