CVE-2026-11630: Use after free in File Input in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in the File Input component of Google Chrome versions prior to 149.0.7827.103 allows a remote attacker to exploit heap corruption. The vulnerability is reachable over the network and requires no authentication, though it does require the victim to visit a crafted HTML page. Successful exploitation gives the attacker full read, write, and availability impact on the affected process, enabling arbitrary code execution or service disruption. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page; the vulnerable service must be reachable from an external or network-adjacent origin.

• AuthenticationNot required

  No account or credential is needed; the attacker can target any user who browses to the malicious page without prior authentication.

• Victim interactionRequired

  The victim must open a crafted HTML page, meaning the attacker relies on phishing, malicious advertising, or another social-engineering vector to trigger the vulnerability.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other unpredictable environmental factors.

Blast Radius

• The attacker gains read access to heap memory in the Chrome renderer process, exposing in-memory session tokens, credentials, and page content.
• The attacker can write to freed heap memory, enabling arbitrary code execution within the renderer process sandbox.
• If a sandbox escape is chained, the attacker can execute code at the privilege level of the Chrome process on the host.
• The vulnerability can also be used to crash the Chrome process, disrupting the user's browsing session and any active web applications.