CVE-2026-11663: Use after free in Skia in Google Chrome prior to 149

Synopsis

Use-after-free in the Skia graphics library within Google Chrome (versions prior to 149.0.7827.103) can be reached by a remote attacker over the network, requiring no authentication but needing the victim to visit a crafted HTML page, and only exploitable after the attacker has already compromised the renderer process. Successful exploitation enables a sandbox escape, granting the attacker capabilities beyond the normally isolated renderer context, including high-impact access to confidentiality, integrity, and availability of the host. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page, so the Chrome instance must be reachable in a browsing context exposed to attacker-controlled content.

• AuthenticationNot required

  No credentials or authenticated session are needed; the attacker only requires the ability to serve or link to a crafted page.

• Victim interactionRequired

  The victim must visit or be redirected to a crafted HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is high because exploitation requires a prior renderer-process compromise as a prerequisite, meaning the attacker must chain this bug with a separate renderer vulnerability rather than exploiting it in isolation.

Blast Radius

• Escapes the Chrome sandbox, breaking out of the renderer isolation boundary and gaining access to the underlying host process context.
• Reads sensitive data accessible to the browser process, including stored credentials, cookies, and session tokens.
• Modifies files or state accessible to the browser process, enabling tampering with local data or browser configuration.
• Crashes or destabilizes the browser process, causing denial of service to the affected user session.