CVE-2026-11644: Use after free in Views in Google Chrome on Linux prior to 149

Synopsis

Use-after-free vulnerability in the Views component of Google Chrome on Linux affects all versions prior to 149.0.7827.103. The flaw is reachable over the network but requires the victim to install a malicious Chrome extension, and no prior authentication is needed. Successful exploitation gives an attacker arbitrary code execution inside the Chrome process on the affected Linux host. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the malicious extension payload over the network, so the host running Chrome must be reachable or the user must be reachable via web-based distribution.

• AuthenticationNot required

  No account or credential on the target system is required; the attack is initiated entirely through user-side extension installation.

• Victim interactionRequired

  The victim must be persuaded to install a crafted malicious Chrome extension, making this a social-engineering-dependent attack.

• Attack complexityDetail

  CVSS rates this AC:H, indicating the exploit depends on environmental factors or conditions beyond simple delivery, such as specific memory layout or timing within the Chrome renderer.

Blast Radius

• An attacker gains arbitrary code execution within the Chrome process on the affected Linux host, with access to everything Chrome can read in that user session.
• Confidential browser data including stored credentials, session cookies, and browsing history is exposed to the attacker.
• The attacker can write to or modify files and resources accessible to the Chrome process under the logged-in user account.
• The Chrome process and any dependent browser functionality can be crashed or destabilized, disrupting the user session.