CVE-2026-11177: Use after free in Omnibox in Google Chrome prior to 149

Synopsis

Use-after-free in the Chrome Omnibox (the address bar component) affects Google Chrome versions prior to 149.0.7827.53. The vulnerability is reachable over the network and requires no authentication, but the attacker must convince a user to perform specific UI gestures on a crafted HTML page. Successful exploitation corrupts heap memory, giving the attacker the ability to read sensitive data, modify application state, or execute arbitrary code within the browser process. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network; the target Chrome instance must be reachable by the user browsing to attacker-controlled content.

• AuthenticationNot required

  No account, credential, or prior authentication is needed; any unauthenticated remote attacker can serve the malicious page.

• Victim interactionRequired

  The attacker must socially engineer the victim into performing specific UI gestures (such as clicking or interacting with the address bar) on a crafted page before the vulnerability triggers.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit does not depend on race conditions, specific memory layouts, or other environmental factors and is expected to be reliable once the victim interaction requirement is met.

Blast Radius

• Reads in-process memory, exposing stored credentials, session tokens, autofill data, and browsing history held in the Chrome process.
• Modifies heap memory, allowing the attacker to alter application state or inject data into the running browser process.
• Achieves arbitrary code execution within the browser process at the privilege level of the logged-in user.
• Crashes the affected Chrome renderer or browser process, causing a denial of service for the user session.