CVE-2026-11638: Use after free in Printing in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in the Printing component of Google Chrome (versions prior to 149.0.7827.103) allows a remote attacker to exploit freed memory by luring a user to a crafted HTML page. The attack requires no authentication and is reachable over the network, but does require the victim to visit or interact with a malicious page. Successful exploitation enables a sandbox escape, giving the attacker full read, write, and availability impact outside Chrome's normal process isolation. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the targeted Chrome instance must be reachable or the user must browse to an attacker-controlled page.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated remote attacker can attempt exploitation.

• Victim interactionRequired

  The victim must visit or be redirected to a crafted HTML page, making social engineering or a malicious ad the typical delivery mechanism.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and requires no special race conditions or specific memory layout to succeed.

Blast Radius

• Attacker escapes the Chrome renderer sandbox and gains code execution in a broader process context.
• Attacker reads arbitrary data accessible to the browser process, including stored credentials, session tokens, and locally cached files.
• Attacker modifies files or data writable by the browser process, including browser profile data and locally stored application state.
• Attacker can crash or destabilize the affected Chrome process, denying service to the user.