CVE-2026-11201: Use after free in ServiceWorker in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in the ServiceWorker component of Google Chrome allows an attacker to execute arbitrary code on the victim's machine. The flaw is reachable over the network but requires the victim to install a malicious Chrome extension crafted by the attacker; no authentication or existing account on the target is needed. Successful exploitation gives the attacker full code execution in the browser process, enabling data theft, tampering, and potential system compromise. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the malicious extension over the network, so the victim's browser must be reachable or the victim must browse to attacker-controlled content.

• AuthenticationNot required

  No account or credential on the target system is needed; the attacker only needs to convince the victim to install the extension.

• Victim interactionRequired

  The victim must be socially engineered into installing a crafted Chrome extension for the exploit to trigger.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable once the extension is installed, with no race conditions or special memory layout requirements noted.

Blast Radius

• The attacker gains arbitrary code execution inside the Chrome browser process, allowing them to read session cookies, saved passwords, and browsing history.
• In-memory and on-disk data accessible to the browser profile can be exfiltrated, including stored credentials and autofill data.
• The attacker can modify web content, inject scripts into pages, or redirect the browser to attacker-controlled destinations.
• Depending on sandbox escape conditions, further privilege escalation to the underlying OS process space is possible.