CVE-2026-11118: Use after free in WebRTC in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability exists in the WebRTC component of Google Chrome prior to version 149.0.7827.53. The flaw is reachable over the network without any authentication, but requires the victim to visit a crafted HTML page the attacker controls. Successful exploitation allows the attacker to execute arbitrary code inside Chrome's renderer sandbox. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by serving a crafted HTML page, so the victim's browser must be able to reach attacker-controlled web content.

• AuthenticationNot required

  No authentication is needed; the attacker requires only that the victim navigates to a page the attacker controls.

• Victim interactionRequired

  The victim must visit or be redirected to the crafted HTML page, making this a social-engineering or malicious-ad delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special environmental conditions or race-condition requirements on the attacker.

Blast Radius

• The attacker executes arbitrary code inside Chrome's renderer sandbox, gaining full control of the sandboxed process.
• Confidential data processed by the renderer, including page content, stored credentials surfaced by autofill, and session tokens, is readable by the attacker.
• The attacker can tamper with page content and any data the renderer writes, enabling manipulation of in-flight requests or displayed information.
• The compromised renderer process can be crashed or held hostage, disrupting the user's browsing session and any web application running in that context.