CVE-2026-11639: Use after free in Compositing in Google Chrome on Mac prior to 149

Synopsis

A use-after-free vulnerability in the Compositing component of Google Chrome on macOS allows a remote attacker to execute arbitrary code. The attacker must deliver a crafted HTML page and have the victim open it, but no authentication is required; the exploit works over the network with high attack complexity due to memory-layout timing requirements. Successful exploitation gives the attacker full code execution inside the Chrome renderer process, enabling data theft, file access, or further privilege escalation. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the victim's browser must be able to reach and load the attacker-controlled HTML page.

• AuthenticationNot required

  No account or credential is needed; the attacker only needs to get the victim to open a crafted URL.

• Victim interactionRequired

  The victim must actively open the crafted HTML page, making this a social-engineering vector such as a phishing link or malicious ad.

• Attack complexityDetail

  Exploitation is rated high complexity, meaning the attacker must win a race condition or arrange a specific memory layout to reliably trigger the use-after-free.

Blast Radius

• A successful attacker achieves arbitrary code execution inside the Chrome renderer process on the victim's Mac.
• Confidential data accessible to the browser, including stored credentials, session tokens, and page content from other open tabs, can be read.
• Attacker-controlled code can write or modify files reachable by the browser process, including cached data and user-profile storage.
• Depending on sandbox posture, the foothold in the renderer can be chained with a sandbox-escape to gain broader host-level access.