CVE-2026-11165: Use after free in WebMIDI in Google Chrome on iOS prior to 149

Synopsis

A use-after-free vulnerability in the WebMIDI component of Google Chrome on iOS allows a remote attacker to exploit freed memory by luring a user to a crafted HTML page. No prior authentication is needed, but the attacker must convince a target to visit a malicious page. Successful exploitation gives the attacker a sandbox escape, granting access to data and processes outside the browser's normal isolation boundary, with high impact to confidentiality, integrity, and availability. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page, so the vulnerable service must be reachable from the internet or an accessible network path.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated user browsing to the malicious page is a viable target.

• Victim interactionRequired

  The attacker must socially engineer the target into opening a crafted HTML page, making user interaction a necessary step in the attack chain.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other hard-to-control environmental factors.

Blast Radius

• The attacker escapes the browser sandbox and gains code execution in a more privileged process context outside normal browser isolation.
• Confidential data accessible to that elevated context, including stored credentials, session tokens, and on-device files, becomes readable.
• The attacker can modify or delete data in that elevated context, tampering with application state or persisted files on the device.
• The attacker can crash or destabilize services running in the affected process space, causing denial of service to the user or dependent components.