CVE-2026-11673: Use after free in InterestGroups in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in the InterestGroups component of Google Chrome prior to version 149.0.7827.103 allows a remote attacker to execute arbitrary code inside the browser sandbox by tricking a user into visiting a crafted HTML page. The attack is reachable over the network, requires no authentication, but does require the victim to load the malicious page. Successful exploitation gives an attacker arbitrary code execution within the Chrome sandbox, which can serve as a stepping stone to further compromise. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the target Chrome instance must be reachable in the sense that the user browses to an attacker-controlled or compromised URL.

• AuthenticationNot required

  No account, credential, or session token is needed; any unauthenticated remote party can serve the malicious page.

• Victim interactionRequired

  The victim must navigate to or be redirected to a crafted HTML page, making this a classic drive-by or social-engineering scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• The attacker executes arbitrary code inside the Chrome renderer sandbox, gaining control of the sandboxed process.
• Confidential data accessible to the renderer, such as in-page credentials, session tokens, and DOM content, is exposed to the attacker.
• The attacker can modify page content and in-browser state, enabling further phishing, credential harvesting, or data tampering within the session.
• While the initial compromise is sandbox-constrained, arbitrary code execution inside the sandbox is a well-established first step toward full sandbox escape and host-level access.