CVE-2026-11230: Use after free in Extensions in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in the Extensions component of Google Chrome (versions prior to 149.0.7827.53) allows a remote attacker to execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The attack is reachable over the network and requires no authentication, but does require the victim to visit or interact with a malicious page. Successful exploitation gives the attacker arbitrary code execution within the Chrome sandbox, which can be a stepping stone to further privilege escalation. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network, so the victim's Chrome instance must be reachable by or directed to an attacker-controlled resource.

• AuthenticationNot required

  No credentials or account privileges are needed; any unauthenticated remote attacker can attempt the exploit.

• Victim interactionRequired

  The victim must visit or be redirected to a crafted HTML page, making this a social-engineering or drive-by-download scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions or specific environmental configurations.

Blast Radius

• Attacker executes arbitrary code inside the Chrome renderer sandbox, gaining control of the sandboxed process.
• Confidential data processed by the browser, such as session tokens, form inputs, and cached credentials, is exposed to the attacker.
• Attacker can modify or forge browser-side state, enabling tampering with web content the victim is actively viewing.
• Browser process integrity is compromised, which can serve as a launchpad for sandbox-escape attempts targeting the underlying host.