CVE-2026-11136: Use after free in Canvas in Google Chrome prior to 149

Synopsis

Use-after-free in the Canvas component of Google Chrome (versions prior to 149.0.7827.53) allows a remote attacker to execute arbitrary code inside the browser sandbox by luring a victim to a crafted HTML page. The vulnerability is reachable over the network and requires no authentication, though the victim must take an action such as visiting a malicious URL. Exploitation gives the attacker code execution within the Chrome sandbox, with high impact on confidentiality, integrity, and availability. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the target Chrome instance must be reachable by directing the victim to an attacker-controlled URL.

• AuthenticationNot required

  No credentials or account on any system are needed; the attack works against any unauthenticated browser session.

• Victim interactionRequired

  The victim must visit a crafted HTML page, meaning the attacker must convince the user to click a link or otherwise navigate to the malicious content.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• The attacker executes arbitrary code within the Chrome renderer sandbox, gaining a foothold for further privilege escalation.
• With high confidentiality impact, the attacker can read in-browser data including session tokens, cookies, and page contents.
• With high integrity impact, the attacker can modify in-browser state, inject content into pages, or tamper with data processed by the renderer.
• With high availability impact, the attacker can crash the affected Chrome process or render it unresponsive.