CVE-2026-11674: Use after free in Guest View in Google Chrome prior to 149

Synopsis

Use-after-free in Guest View in Google Chrome (versions prior to 149.0.7827.103) allows a remote attacker to execute arbitrary code inside the Chrome sandbox by tricking a user into visiting a crafted HTML page. The vulnerability is reachable over the network and requires no authentication, but does require the victim to open a malicious page. Successful exploitation gives the attacker arbitrary code execution within the browser sandbox, with high impact to confidentiality, integrity, and availability. A patched-image rebuild at 149.0.7827.103 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by hosting a crafted HTML page that the victim's browser fetches remotely.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated remote attacker can attempt the exploit.

• Victim interactionRequired

  The victim must navigate to or open a crafted HTML page, requiring a social-engineering step such as a phishing link or malicious ad.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other environmental factors.

Blast Radius

• Executes arbitrary code inside the Chrome renderer sandbox, giving the attacker a foothold within the browser process.
• Reads sensitive data accessible to the browser context, including session tokens, cached credentials, and page content from open tabs.
• Modifies browser state or data accessible within the sandbox, enabling tampering with rendered content or local storage.
• Crashes or destabilizes the affected Chrome process, causing denial of service for the user session.