CVE-2026-11648: Use after free in FullScreen in Google Chrome on Windows prior to 149

Synopsis

A use-after-free vulnerability exists in the FullScreen component of Google Chrome on Windows in versions prior to 149.0.7827.103. The flaw is reachable over the network without authentication, but requires a user to visit a crafted HTML page. Successful exploitation corrupts heap memory and gives an attacker the ability to read sensitive data, modify application state, or execute arbitrary code within the browser process. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing a victim to a remotely hosted crafted HTML page, so the Chrome instance must be reachable to normal web browsing.

• AuthenticationNot required

  No account or credentials on the target system are required; any user who browses to the attacker-controlled page is a valid target.

• Victim interactionRequired

  A victim must actively open or be redirected to a crafted HTML page, making social engineering or malicious advertising the typical delivery mechanism.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental preconditions.

Blast Radius

• Reads heap memory contents from the Chrome process, which can include stored session cookies, cached credentials, and page content from other open tabs.
• Writes to heap memory, allowing the attacker to modify application state or corrupt data structures inside the browser process.
• Enables arbitrary code execution within the Chrome renderer or browser process on the affected Windows host.
• Crashes the affected Chrome instance if the heap corruption is not steered into a controlled exploit, causing loss of unsaved browser state.