CVE-2026-11661: Use after free in Views in Google Chrome on Windows prior to 149

Synopsis

A use-after-free vulnerability exists in the Views component of Google Chrome on Windows in versions prior to 149.0.7827.103. The flaw is reachable over the network and requires no authentication, though it does require the attacker to have already compromised the renderer process and to trick a user into visiting a crafted HTML page. Successful exploitation allows the attacker to escape Chrome's sandbox, gaining code execution at the browser process level with access to confidential data, the ability to tamper with the system, and the potential to crash or destabilize the host. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target over the network by serving a crafted HTML page to a victim's browser.

• AuthenticationNot required

  No account or credentials are required on the target system to initiate the attack.

• Victim interactionRequired

  A user must be socially engineered into visiting or loading the attacker's crafted HTML page for exploitation to proceed.

• Attack complexityDetail

  Exploitation requires the attacker to have already compromised the renderer process, introducing environmental preconditions and making reliable exploitation dependent on chaining this with a separate renderer bug.

Blast Radius

• A successful attacker escapes Chrome's renderer sandbox and gains execution at the browser process level on the Windows host.
• Confidential data accessible to the browser process, including stored credentials, session tokens, and browsing history, is exposed to the attacker.
• The attacker can write or modify files and registry entries accessible to the browser process on the host.
• The browser process can be crashed or the host destabilized, causing a denial of service for the affected user.