CVE-2026-11634: Use after free in Gamepad in Google Chrome on Windows prior to 149

Synopsis

Use-after-free in the Gamepad API component of Google Chrome on Windows (versions prior to 149.0.7827.103) allows a remote attacker to trigger a sandbox escape by delivering a crafted HTML page. The vulnerability is reachable over the network with no authentication required, but does require a user to visit or be redirected to a malicious page. Successful exploitation gives the attacker code execution outside the Chrome sandbox, with full confidentiality, integrity, and availability impact on the host. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the target to a crafted HTML page, so the Chrome instance must be reachable from or navigable to an attacker-controlled origin.

• AuthenticationNot required

  No account or credential is needed on the targeted system; the attack is initiated entirely through a crafted web page.

• Victim interactionRequired

  The target user must visit or be redirected to the attacker's crafted HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other variable environmental factors.

Blast Radius

• Attacker escapes the Chrome renderer sandbox and executes arbitrary code in the context of the browser process on the Windows host.
• Reads files, credentials, and session tokens accessible to the user running Chrome, including anything stored on disk or in memory.
• Modifies files and system state on the Windows host within the permissions of the compromised user account.
• Crashes or destabilizes Chrome or dependent host processes, causing denial of service for the affected user session.