CVE-2026-11636: Use after free in Autofill in Google Chrome on Windows prior to 149

Synopsis

A use-after-free vulnerability in the Autofill component of Google Chrome on Windows (versions prior to 149.0.7827.103) allows a remote attacker to corrupt heap memory. Exploitation requires convincing a user to perform specific UI gestures on a crafted HTML page, and the attack must be delivered over the network under conditions that add some complexity. Successful exploitation gives the attacker full read, write, and crash capability over the affected process. A patched-image rebuild at 149.0.7827.103 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the targeted Chrome instance must be reachable from or directed to an attacker-controlled origin.

• AuthenticationNot required

  No authentication is needed; any unauthenticated remote attacker can serve the malicious page.

• Victim interactionRequired

  The user must be convinced to perform specific UI gestures (for example, interacting with Autofill prompts) on the attacker-crafted page, making social engineering a prerequisite.

• Attack complexityDetail

  Attack complexity is rated High, meaning the attacker must account for race conditions or precise heap-layout factors to reliably trigger the use-after-free and achieve controlled corruption.

Blast Radius

• Reads sensitive data held in the browser process, including stored Autofill field contents such as addresses and payment details rendered in the active session.
• Writes arbitrary data into heap memory, enabling the attacker to overwrite internal browser structures and redirect code execution.
• Crashes the affected Chrome renderer or browser process, disrupting the user's session and any in-flight transactions.
• Achieves arbitrary code execution within the browser process under the privileges of the logged-in Windows user, enabling further host-level actions.