CVE-2026-11652: Use after free in Extensions in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in the Extensions component of Google Chrome prior to version 149.0.7827.103 allows a remote attacker who has already compromised the renderer process to escape Chrome's sandbox by delivering a crafted HTML page. The attack requires no special privileges but does require the victim to visit or interact with attacker-controlled content, and the attacker must also have pre-compromised the renderer. Successful exploitation gives the attacker full read, write, and denial-of-service capability beyond the browser sandbox, effectively breaking the primary security boundary between web content and the underlying host. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network by serving a crafted HTML page from a remote location, making the service's network exposure a prerequisite.

• AuthenticationNot required

  No account or credential is needed; the attack is reachable by any unauthenticated remote party who can get the victim to load content.

• Victim interactionRequired

  The victim must visit or otherwise load the attacker-crafted HTML page, making a social-engineering or malicious-link delivery step necessary.

• Attack complexityDetail

  Attack complexity is HIGH, meaning the attacker must first have compromised the renderer process through a separate exploit before this sandbox-escape step can be attempted, introducing an environmental dependency beyond the attacker's direct control.

Blast Radius

• An attacker who successfully escapes the sandbox reads arbitrary data accessible to the Chrome process, including stored session tokens, credentials, and profile data.
• The attacker gains the ability to write to file system locations and modify data accessible outside the browser sandbox.
• Full compromise of sandbox isolation means the attacker can execute code at the privilege level of the browser process on the host operating system.
• The attacker can crash or destabilize the browser process, causing a denial of service for the affected user.