CVE-2026-11629: Use after free in Ozone in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability affects the Ozone graphics layer in Google Chrome versions prior to 149.0.7827.103. The flaw is reachable over the network and requires no authentication, but does require the victim to visit a crafted HTML page. Successful exploitation gives the attacker heap corruption, enabling arbitrary code execution as well as full read and write access to affected memory. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by luring the victim to a remotely hosted crafted HTML page, so the Chrome process must be reachable through normal web browsing.

• AuthenticationNot required

  No account or credential of any kind is required; the attacker needs only the victim to load the malicious page.

• Victim interactionRequired

  The victim must actively open or be redirected to a crafted HTML page, making this a social-engineering vector (phishing link, malicious ad, etc.).

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other unpredictable environmental factors.

Blast Radius

• Reads arbitrary heap memory from the Chrome process, exposing stored credentials, session tokens, and in-memory page content.
• Writes to arbitrary heap memory, allowing the attacker to corrupt internal browser structures and redirect execution flow.
• Achieves code execution within the Chrome renderer or browser process under the privileges of the logged-in user.
• Crashes the affected Chrome process if exploitation is imprecise, causing a denial of service for the browser session.