CVE-2026-11651: Use after free in Network in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in the Network component of Google Chrome (versions prior to 149.0.7827.103) allows a remote attacker to execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The flaw is reachable over the network with no authentication required, but does require the victim to open a malicious page. Successful exploitation gives the attacker arbitrary code execution within the Chrome sandbox, which combined with a secondary sandbox-escape primitive could lead to full host compromise. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the victim's browser must be able to reach (or be directed to) an attacker-controlled or compromised web server.

• AuthenticationNot required

  No account or credential of any kind is required; any unauthenticated remote party can serve the malicious page.

• Victim interactionRequired

  The victim must open a crafted HTML page, meaning the attacker depends on phishing, a malicious ad, or another social-engineering vector to trigger the vulnerability.

• Attack complexityDetail

  Attack complexity is Low: the exploit is reliable and requires no race-condition timing, specific memory layout, or other environmental preconditions beyond the victim visiting the page.

Blast Radius

• The attacker achieves arbitrary code execution inside the Chrome renderer sandbox, enabling the attacker to read any data accessible to the renderer process such as in-memory session tokens and page content.
• The attacker can modify renderer-controlled state and inject content into pages the victim is browsing, including injecting scripts or altering displayed data.
• With code execution in the sandbox, a chained sandbox-escape exploit would grant the attacker full access to the host process, including all files and credentials accessible to the browser.
• The browser process can be crashed or kept in a controlled state, disrupting the user's session and any browser-mediated workflows.