CVE-2026-11125: Use after free in Compositing in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in the Compositing component of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker must reach the victim over the network, but no authentication is required; the victim must visit a crafted HTML page. Successful exploitation gives the attacker code execution within the Chrome sandbox, which can be a stepping stone to further privilege escalation. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by luring the victim to a crafted page; the Chrome process must be reachable in the sense that the victim's browser fetches attacker-controlled content.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated remote party can serve the malicious HTML page.

• Victim interactionRequired

  The victim must visit or be redirected to a crafted HTML page, making this a social-engineering-dependent exploit.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other unpredictable environmental factors.

Blast Radius

• Attacker executes arbitrary code inside the Chrome renderer sandbox on the victim's host.
• Attacker reads in-browser data such as session cookies, saved credentials, and page content (high confidentiality impact).
• Attacker modifies in-browser state, including DOM content and stored site data (high integrity impact).
• Attacker can crash or hang the affected Chrome process, denying the user access to the browser (high availability impact).