CVE-2026-11643: Use after free in Proxy in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in the Proxy component of Google Chrome prior to version 149.0.7827.103 allows a remote attacker to execute arbitrary code by sending malicious network traffic to the browser. The vulnerability is reachable over the network without any authentication or user interaction, though exploitation requires overcoming high attack complexity conditions. Successful exploitation gives the attacker full code execution in the context of the browser process, enabling data theft, tampering, and service disruption. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target over the network by delivering malicious traffic to a browser session exposed to untrusted network content.

• AuthenticationNot required

  No account or credential of any privilege level is needed to deliver the exploit payload.

• Victim interactionNot required

  The exploit is delivered through network traffic without requiring the user to click, open a file, or take any other action.

• Attack complexityDetail

  Exploitation is rated high complexity, meaning the attacker must satisfy specific conditions such as race conditions or precise memory layout requirements that are not fully under attacker control.

Blast Radius

• The attacker executes arbitrary code in the context of the Chrome browser process on the target host.
• Confidential data accessible to the browser, including stored credentials, session tokens, and browsing history, is exposed.
• The attacker can modify browser state, write files accessible to the browser process, or pivot to other resources the browser can reach.
• The browser process can be crashed or rendered inoperable, denying service to the affected user.