CVE-2026-11642: Use after free in Web Apps in Google Chrome prior to 149

Synopsis

Use-after-free in the Web Apps component of Google Chrome (versions prior to 149.0.7827.103) allows a remote attacker who has already compromised the renderer process to escape the browser sandbox by delivering a crafted HTML page. The vulnerability is reachable over the network and requires no authentication, though it does require victim interaction and the attacker must have an established renderer-process foothold. Successful exploitation gives the attacker full read, write, and availability impact beyond the sandbox boundary. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the target Chrome instance must be reachable and browsing externally accessible content.

• AuthenticationNot required

  No account or credential is required; the attack is launched from an unauthenticated remote position.

• Victim interactionRequired

  The target user must navigate to or open a crafted HTML page, making social engineering or a malicious link a necessary part of the attack chain.

• Attack complexityDetail

  Attack complexity is HIGH, meaning the attacker must already hold a compromised renderer process before this bug can be used to escape the sandbox, introducing a meaningful prerequisite condition.

Blast Radius

• Attacker escapes the Chrome sandbox, gaining code execution in a higher-privilege process context outside browser confinement.
• Confidential data accessible to that process, including stored credentials, session tokens, and files visible to the browser profile, can be read.
• The attacker can write to or modify files and system state reachable by the escaped process.
• The host process can be crashed or rendered unavailable, disrupting the browser and any dependent workflows.