CVE-2026-11679: Use after free in Codecs in Google Chrome on Windows prior to 149

Synopsis

Use-after-free in the Codecs component of Google Chrome on Windows (versions prior to 149.0.7827.103) allows a remote attacker who has already compromised the renderer process to escape Chrome's sandbox via a crafted HTML page. The vulnerability is reachable over the network and requires no authentication, though it does require the victim to interact with a malicious page and depends on the attacker having renderer-level compromise in place first. Successful exploitation gives the attacker code execution outside the Chrome sandbox, effectively breaking out of the browser's primary containment boundary. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network by delivering a crafted HTML page, as indicated by AV:N in the CVSS vector.

• AuthenticationNot required

  No authentication or account credentials are needed; the attacker interacts with the victim as an anonymous party, per PR:N.

• Victim interactionRequired

  The victim must visit or render a crafted HTML page, meaning a social-engineering step (such as clicking a link or opening a file) is necessary, per UI:R.

• Attack complexityDetail

  Attack complexity is rated High (AC:H), meaning the attacker must already have compromised the renderer process before this vulnerability can be used to escape the sandbox, introducing a significant prerequisite.

Blast Radius

• A successful attacker breaks out of the Chrome sandbox on Windows, gaining code-execution capability at the privilege level of the browser process rather than the restricted renderer.
• With sandbox escape achieved, the attacker can read files and credentials accessible to the Chrome process user account on the host.
• The attacker can write or modify files on the host filesystem within the reach of that user account, enabling persistence mechanisms or tampering with local data.
• Full integrity, confidentiality, and availability impact (C:H, I:H, A:H) means the attacker can also crash or destabilize the affected process and any dependent services.