CVE-2026-11656: Use after free in ServiceWorker in Google Chrome prior to 149

Synopsis

Use-after-free vulnerability in the ServiceWorker component of Google Chrome prior to version 149.0.7827.103 allows a remote attacker to escape the browser sandbox. The attacker must convince a target user to install a malicious Chrome extension, after which the extension can trigger the freed-memory condition over the network. Successful exploitation gives the attacker high-impact access to confidentiality, integrity, and availability outside the browser sandbox. A patched-image rebuild at 149.0.7827.103 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the malicious extension payload over the network, so the targeted host must be reachable or the user must browse to an attacker-controlled origin.

• AuthenticationNot required

  No account or credential is needed; the attacker only needs to get the victim to install the crafted extension.

• Victim interactionRequired

  The user must be socially engineered into installing a malicious Chrome extension, making victim interaction a hard prerequisite for exploitation.

• Attack complexityDetail

  The CVSS vector marks complexity as High, meaning the exploit depends on specific memory-state conditions or timing that the attacker cannot fully control, reducing reliability.

Blast Radius

• The attacker escapes the Chrome renderer sandbox, gaining code execution in a more privileged process context on the host.
• With sandbox escape achieved, the attacker can read files, credentials, and session tokens accessible to the browser process user account.
• The attacker can write or modify data on the local filesystem or inject into other running processes at the same privilege level.
• The attacker can crash or destabilize browser processes and potentially other host-level services, disrupting availability.