CVE-2026-11646: Use after free in ViewTransitions in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in the ViewTransitions component of Google Chrome prior to version 149.0.7827.103 allows a remote attacker to execute arbitrary code inside the Chrome sandbox. The attacker reaches the vulnerability over the network and requires no authentication, but does need the victim to visit a crafted HTML page. Successful exploitation grants the attacker code execution within the browser sandbox, which can be chained with a sandbox escape for deeper system compromise. A patched-image rebuild at 149.0.7827.103 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim's browser over the network by serving a crafted HTML page from a remote origin.

• AuthenticationNot required

  No account or credential is needed; the attacker only needs the victim to load the malicious page.

• Victim interactionRequired

  The victim must visit the attacker-controlled page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions or specific memory layout assumptions.

Blast Radius

• The attacker executes arbitrary code inside the Chrome renderer sandbox, gaining full control over the renderer process.
• Confidential data processed by the browser, including session tokens, cookies, and page contents, is readable by the attacker.
• The attacker can modify browser-managed state and data within the sandboxed process, including in-memory form data and cached resources.
• The renderer process can be crashed or held, disrupting the user's browsing session and any web application running in the affected tab.