CVE-2026-11164: Use after free in Blink in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in Blink, the rendering engine of Google Chrome prior to version 149.0.7827.53, allows a remote attacker to execute arbitrary code. The attacker delivers a crafted HTML page over the network and requires no authentication, but does need the victim to visit the page in a browser. Successful exploitation results in arbitrary code execution inside Chrome's sandbox, enabling further attack chaining against the host. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the victim's browser must be reachable from or directed to an attacker-controlled internet location.

• AuthenticationNot required

  No account or credential is needed; the attacker only has to serve a malicious page to the target.

• Victim interactionRequired

  The victim must open the crafted HTML page in an affected version of Chrome, making this a social-engineering vector (phishing link, malicious ad, or similar).

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, memory-layout guesses, or other environmental factors.

Blast Radius

• Executes arbitrary code inside Chrome's renderer sandbox, giving the attacker a foothold for further sandbox-escape attempts.
• Reads in-browser data such as stored session cookies, autofill values, and page content from any origin loaded in the compromised renderer.
• Modifies or injects content into pages rendered by the affected process, enabling credential harvesting or silent form tampering.
• Crashes or destabilizes the affected browser process, disrupting the victim's session and any dependent services.