CVE-2026-11632: Use after free in TabStrip in Google Chrome prior to 149

Synopsis

Use-after-free vulnerability in the TabStrip component of Google Chrome (versions prior to 149.0.7827.103) allows a remote attacker to execute arbitrary code on the victim's machine. The attacker reaches the target over the network but must convince the user to perform specific UI gestures on a crafted HTML page; no prior authentication or account is needed. Successful exploitation gives the attacker full code execution in the browser process, enabling data theft, tampering, or further system compromise. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page, so the target's browser must be reachable via normal web browsing.

• AuthenticationNot required

  No account or credential is required; the attacker only needs the victim to visit a page they control.

• Victim interactionRequired

  The victim must perform specific UI gestures (such as interacting with browser tabs) on the attacker-crafted page, making social engineering a necessary part of the attack chain.

• Attack complexityDetail

  Exploitation is rated AC:H, meaning the attacker must account for timing, memory layout, or precise sequencing of UI interactions rather than firing a reliable, condition-free exploit.

Blast Radius

• Attacker gains arbitrary code execution inside the Chrome browser process, able to run any code the browser can run.
• Reads browser-stored data including session cookies, saved passwords, and cached page content belonging to the victim.
• Modifies or exfiltrates data the browser can reach, including authenticated web sessions and local file access permitted by the browser.
• Crashes or destabilizes the browser process, disrupting the victim's active session and any open tabs.