CVE-2026-11144: Use after free in Media in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability affects the Media component of Google Chrome prior to version 149.0.7827.53. The flaw is reachable over the network and requires no authentication, but a victim must open a crafted video file, after which an attacker gains arbitrary code execution inside Chrome's renderer sandbox. Successful exploitation gives the attacker full control of the sandboxed renderer process, enabling data theft, content tampering, and potential sandbox-escape chaining. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted video file over the network, so the victim's browser must be reachable or the attacker must be able to serve content to it via the internet or an internal network.

• AuthenticationNot required

  No account or credential is needed; the attacker only needs to get a victim to open a malicious video file.

• Victim interactionRequired

  A victim must actively open or be redirected to a crafted video file, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• Executes arbitrary code inside Chrome's renderer sandbox, giving the attacker full control of the renderer process.
• Reads in-browser session tokens, saved credentials, and any page content loaded in the affected tab.
• Modifies or injects content into pages the victim is viewing, enabling credential harvesting or malicious redirects.
• Serves as a foothold for sandbox-escape chaining if a second vulnerability targeting the browser process or OS is available.