CVE-2026-11649: Use after free in V8 in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in V8, the JavaScript engine embedded in Google Chrome, allows a remote attacker to execute arbitrary code inside the browser sandbox by luring a victim to a crafted HTML page. The flaw is reachable over the network and requires no authentication, only a single user interaction (visiting the malicious page). Successful exploitation gives the attacker code execution within the Chrome sandbox, which can be chained with a sandbox-escape to achieve full compromise. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by hosting a crafted HTML page that the victim's browser fetches remotely.

• AuthenticationNot required

  No account or credential of any kind is needed; any visitor to the malicious page is a valid target.

• Victim interactionRequired

  The victim must visit the attacker-controlled HTML page, making this a social-engineering vector (phishing link, malicious ad, compromised site, etc.).

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no specific race condition, memory layout, or environmental prerequisite beyond the victim loading the page.

Blast Radius

• The attacker gains arbitrary code execution inside the Chrome renderer sandbox, allowing JavaScript and native code to run at the renderer's privilege level.
• Confidential data accessible to the renderer, including page content, session cookies, and in-memory credentials for open tabs, can be read.
• Integrity of rendered content and local storage accessible to the sandbox can be modified by attacker-controlled code.
• A sandbox-escape primitive chained with this vulnerability enables full access to the underlying host process and its file system.