CVE-2026-11631: Use after free in Aura in Google Chrome on Windows prior to 149

Synopsis

Use-after-free vulnerability in the Aura windowing layer of Google Chrome on Windows, affecting all versions prior to 149.0.7827.103. The vulnerability is reachable over the network but requires the attacker to have already compromised the Chrome renderer process and to trick a user into visiting a crafted HTML page; attack complexity is high due to these prerequisites. Successful exploitation enables a sandbox escape, giving the attacker code execution outside the Chrome sandbox with full confidentiality, integrity, and availability impact on the host. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by serving a crafted HTML page to the target user's browser.

• AuthenticationNot required

  No authentication is needed; the attacker only needs to lure the target to a malicious page.

• Victim interactionRequired

  The target user must visit or be redirected to the attacker-controlled HTML page, making social engineering or malicious-ad delivery a necessary step.

• Attack complexityDetail

  Exploitation is high complexity: the attacker must first have compromised the Chrome renderer process before this use-after-free can be leveraged for a sandbox escape, introducing a significant staging requirement.

Blast Radius

• Attacker escapes the Chrome sandbox and executes arbitrary code in the context of the browser process on the Windows host.
• Reads files, credentials, and session data accessible to the browser process, including stored passwords and cookies.
• Modifies or deletes files and data writable by the browser process, including browser profile data and downloaded files.
• Crashes or destabilizes the browser process, causing denial of service for the affected user session.