CVE-2026-11147: Use after free in WebML in Google Chrome on Windows prior to 149

Synopsis

A use-after-free vulnerability in the WebML component of Google Chrome on Windows allows a remote attacker to execute arbitrary code inside the browser sandbox by persuading a user to visit a crafted HTML page. The bug is reachable over the network with no authentication required, but the attacker must trick a victim into loading a malicious page. Successful exploitation gives the attacker code execution within the Chrome sandbox, which can be a stepping stone to further privilege escalation. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the victim's browser must be able to reach an attacker-controlled or compromised web server.

• AuthenticationNot required

  No account or credential of any kind is required; the attacker only needs the victim to load a page.

• Victim interactionRequired

  The victim must be socially engineered into visiting a crafted HTML page, making this a user-driven social-engineering vector.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other hard-to-control environmental factors.

Blast Radius

• The attacker gains arbitrary code execution inside the Chrome renderer sandbox on the affected Windows host.
• Confidential data accessible to the renderer process, including page contents, stored credentials surfaced by autofill, and session state, is exposed.
• The attacker can tamper with rendered content and intercept or modify data in transit within the compromised tab context.
• Sandbox escape primitives combined with this bug can be chained to achieve broader host-level compromise, though that requires an additional vulnerability.