CVE-2026-11637: Use after free in Views in Google Chrome on Mac prior to 149

Synopsis

A use-after-free vulnerability affects the Views component of Google Chrome on macOS in versions prior to 149.0.7827.103. The bug is reachable over the network without any credentials, but requires a victim to visit a crafted HTML page. Successful exploitation gives an attacker arbitrary code execution on the victim's machine. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page, so the service must be reachable from a remote origin.

• AuthenticationNot required

  No account or credential of any kind is needed before the exploit executes.

• Victim interactionRequired

  The victim must open or be redirected to an attacker-controlled HTML page, making social engineering or a malicious link a prerequisite.

• Attack complexityDetail

  The exploit is reliable and condition-free once the victim visits the page; no race conditions or specific memory-layout prerequisites are required.

Blast Radius

• Attacker executes arbitrary native code in the context of the Chrome renderer process on the victim's Mac.
• With code execution in the renderer, an attacker can read files and session tokens accessible to the browser process.
• An attacker can write or modify data on the local filesystem within the browser's accessible scope.
• The compromised process can be used as a foothold for further lateral movement on the host system.