CVE-2026-11664: Use after free in Payments in Google Chrome prior to 149

Synopsis

Use-after-free in the Payments component of Google Chrome (versions before 149.0.7827.103) allows a remote attacker to corrupt heap memory by luring a user to a crafted HTML page. No authentication is required; the attacker only needs the victim to visit a malicious URL. Successful exploitation gives the attacker read and write access to process memory and can crash the browser, enabling potential remote code execution. A patched-image rebuild at 149.0.7827.103 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the victim's browser must be able to reach an attacker-controlled HTML page.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated remote attacker can attempt exploitation.

• Victim interactionRequired

  The victim must visit or be redirected to a crafted HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions or specific environmental configuration to succeed.

Blast Radius

• Reads process memory contents, which may include stored payment data, session tokens, and browser-cached credentials.
• Writes to heap memory, allowing the attacker to overwrite internal browser structures and potentially redirect code execution.
• Crashes the affected Chrome renderer or browser process, disrupting the user's session.
• Combined memory read and write primitives at this severity level are the prerequisite for full remote code execution within the browser process.