CVE-2026-11293: Use after free in Input in Google Chrome prior to 149

Synopsis

Use-after-free in the Input component of Google Chrome (all versions prior to 149.0.7827.53) allows a remote attacker to exploit freed memory by delivering a crafted HTML page to a victim's browser. The vulnerability is reachable over the network, requires no authentication, and succeeds once a user visits or is redirected to a malicious page. Successful exploitation enables a sandbox escape, giving the attacker full read, write, and execution capabilities beyond the browser sandbox. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the victim's browser must be able to reach or be directed to the attacker-controlled page.

• AuthenticationNot required

  No account or credential of any kind is needed; any user who visits the crafted page is exposed.

• Victim interactionRequired

  The victim must open or be redirected to a crafted HTML page, making this a social-engineering or malicious-link delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no race conditions, special memory layout, or other environmental preconditions.

Blast Radius

• A successful attacker escapes the Chrome renderer sandbox, gaining code execution in the context of the browser process on the victim host.
• With sandbox escape achieved, the attacker can read files, stored credentials, and session tokens accessible to the browser process.
• The attacker can write or modify files and data reachable by the browser process, including user profile data and cached content.
• The browser process can be crashed or held, disrupting the user session and any dependent services relying on the browser runtime.