CVE-2026-11130: Use after free in Media in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in the Media component of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The flaw is reachable over the network and requires no authentication, though the victim must visit a malicious page. Successful exploitation gives an attacker code execution within the Chrome sandbox, which combined with a sandbox-escape primitive could lead to full compromise of the host process. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected Chrome version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a remotely hosted crafted HTML page, so the Chrome instance must be reachable to the open internet or an internal web server.

• AuthenticationNot required

  No account or credential is needed; the attacker only needs the victim to load a page under their control.

• Victim interactionRequired

  The victim must actively visit or be redirected to the attacker-controlled HTML page, making this a social-engineering or drive-by scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors outside the attacker's control.

Blast Radius

• An attacker gains arbitrary code execution inside the Chrome renderer sandbox, allowing them to run attacker-supplied instructions within that process.
• Confidential data processed by the renderer, such as page contents, cookies, and in-memory credentials, becomes readable to the attacker.
• The attacker can tamper with rendered content and browser state, enabling session hijacking or in-browser data modification.
• If chained with a sandbox-escape, the attacker reaches the underlying host OS, potentially compromising all data and processes on the machine.