CVE-2026-11671: Use after free in Navigation in Google Chrome prior to 149

Synopsis

Use-after-free in the Navigation component of Google Chrome (versions prior to 149.0.7827.103) allows a remote attacker to trigger a sandbox escape by delivering a crafted HTML page to a target user. The vulnerability is reachable over the network and requires no authentication, though the victim must visit or render the malicious page. Successful exploitation gives the attacker full read, write, and availability impact beyond the browser sandbox, enabling code execution or data theft on the underlying host. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the target Chrome instance must be reachable by or capable of fetching the crafted HTML page from an attacker-controlled origin.

• AuthenticationNot required

  No account or credential is needed on the target system; any unauthenticated party who can serve content to the victim browser can attempt exploitation.

• Victim interactionRequired

  The victim must navigate to or render the attacker-crafted HTML page, making this a social-engineering or malicious-link delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other unpredictable environmental factors.

Blast Radius

• Attacker escapes the Chrome renderer sandbox and gains code execution in the context of the browser process or host OS.
• Confidential data accessible to the browser, including stored credentials, session cookies, and local files, becomes readable by the attacker.
• The attacker can write or modify files and OS-level state accessible to the compromised process.
• The affected Chrome process and any dependent services can be crashed or rendered unavailable.