CVE-2026-11224: Use after free in Chromoting in Google Chrome on Linux prior to 149

Synopsis

A use-after-free vulnerability in the Chromoting component of Google Chrome on Linux allows a remote attacker to execute arbitrary code. The flaw is reachable over the network without any prior authentication, though it requires the victim to interact with malicious network traffic (see exploit conditions below). Successful exploitation gives the attacker full code execution inside the Chrome process, with access to everything the browser can read, write, or connect to. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim's Chrome instance over the network, as the attack vector is AV:N.

• AuthenticationNot required

  No account or credential is needed before triggering the vulnerability (PR:N).

• Victim interactionRequired

  The victim must interact with malicious network traffic, such as visiting an attacker-controlled page or processing crafted remote-desktop session data (UI:R).

• Attack complexityDetail

  Attack complexity is Low (AC:L), meaning the exploit is reliable and requires no special timing, race conditions, or environmental prerequisites.

Blast Radius

• Reads session cookies, saved passwords, and any data accessible to the Chrome process on the host.
• Writes or modifies files and browser state within the scope of the running Chrome user account.
• Crashes or destabilizes the Chrome process, disrupting any active remote-desktop or browser sessions.
• Serves as a foothold for further lateral movement if the compromised Linux host has additional network access.