CVE-2026-11185: Use after free in V8 in Google Chrome prior to 149

Synopsis

Use-after-free in the V8 JavaScript engine inside Google Chrome (versions prior to 149.0.7827.53) allows a remote attacker to execute arbitrary code within Chrome's sandbox. The vulnerability is reachable over the network and requires no authentication, but the attacker must convince the target user to install a malicious Chrome extension. Successful exploitation gives the attacker arbitrary code execution inside the browser sandbox, with high-confidence access to sensitive browser data and the ability to tamper with page content. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the malicious extension or convinces the user to install it via an over-the-network vector, so the target's browser must be reachable or actively browsing.

• AuthenticationNot required

  No account credentials or prior authentication to any service are needed to stage the attack.

• Victim interactionRequired

  The user must be socially engineered into installing a crafted malicious Chrome extension for the exploit to trigger.

• Attack complexityDetail

  The exploit is reliable and imposes no special race-condition or memory-layout requirements once the malicious extension is installed.

Blast Radius

• Arbitrary code executes inside the Chrome renderer sandbox, giving the attacker control over the browser process.
• The attacker reads high-sensitivity browser data such as stored session cookies, saved credentials, and page content from active tabs.
• The attacker modifies in-flight page content or injects scripts, enabling credential harvesting or redirection of browser requests.