CVE-2026-11657: Use after free in Payments in Google Chrome on Mac prior to 149

Synopsis

Use-after-free vulnerability in the Payments component of Google Chrome on macOS affects all Chrome versions prior to 149.0.7827.103. The flaw is reachable over the network and requires no authentication, but does require the victim to visit a crafted HTML page. Successful exploitation gives the attacker arbitrary code execution in the context of the browser process. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the victim's browser must be able to reach an attacker-controlled or compromised web server.

• AuthenticationNot required

  No account or credential of any kind is needed; any user browsing to the crafted page is a valid target.

• Victim interactionRequired

  The victim must visit a crafted HTML page, making this a social-engineering or drive-by delivery scenario requiring at least one click or navigation action.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• The attacker gains arbitrary code execution inside the Chrome browser process on the victim's macOS host.
• Confidentiality impact is high: the attacker can read browser memory, stored credentials, session tokens, autofill data including payment card details, and files accessible to the browser process.
• Integrity impact is high: the attacker can write or modify data in the browser process, plant files, or pivot to other browser-accessible storage.
• Availability impact is high: the attacker can crash or hang the browser process, and may use code execution to disrupt or destroy broader host resources.