CVE-2026-11650: Use after free in V8 in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in V8, the JavaScript engine embedded in Google Chrome prior to version 149.0.7827.103, allows a remote attacker to execute arbitrary code inside Chrome's sandbox by luring a user to a crafted HTML page. The attack is reachable over the network, requires no authentication, but does require the victim to visit a malicious page. Successful exploitation gives the attacker arbitrary code execution within the browser sandbox, which can serve as a stepping stone to further compromise. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page hosted remotely, so the Chrome instance must be reachable via normal web browsing.

• AuthenticationNot required

  No account, credential, or prior access to any system is needed; any visitor to the attacker-controlled page is a viable target.

• Victim interactionRequired

  The victim must navigate to or be redirected to the crafted HTML page, making this a social-engineering vector that requires at least one user action such as clicking a link.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other unpredictable environmental factors.

Blast Radius

• The attacker gains arbitrary code execution within Chrome's V8 JavaScript engine sandbox, enabling full control over script execution in that context.
• Confidential data accessible to the browser process, including session tokens, saved credentials, and page content, is exposed to the attacker.
• The attacker can read and tamper with data rendered or stored by the browser, including form inputs and locally cached content.
• The sandboxed process can be used as a launch point for further exploitation attempts targeting the underlying host operating system.