CVE-2026-11262: Use after free in TabStrip in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in the TabStrip component of Google Chrome prior to version 149.0.7827.53 allows a remote attacker to execute arbitrary code. The vulnerability is reachable over the network and requires no authentication, but does require the target user to visit a crafted HTML page. Successful exploitation gives the attacker full code execution in the context of the browser process, enabling confidentiality loss, data tampering, and service disruption. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing or luring the target to a crafted HTML page hosted remotely.

• AuthenticationNot required

  No account, session token, or prior access to the target system is needed to deliver the exploit.

• Victim interactionRequired

  The target user must visit or be redirected to an attacker-controlled HTML page, making this a social-engineering or drive-by vector.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• A successful attacker executes arbitrary code within the Chrome browser process on the victim's machine.
• The attacker reads browser-stored data including cookies, saved passwords, and session tokens for sites the user is logged into.
• The attacker can modify or delete locally accessible files and data reachable from the browser process.
• The attacker can crash or hang the browser, disrupting the user's session and any in-progress work.