CVE-2026-11681: Use after free in Ozone in Google Chrome on Linux prior to 149

Synopsis

A use-after-free vulnerability in the Ozone display subsystem of Google Chrome on Linux affects all Chrome versions prior to 149.0.7827.103. The flaw is reachable over the network without authentication, but requires a user to visit a crafted HTML page, giving an attacker a path to heap corruption. Successful exploitation grants full read, write, and crash capabilities over the affected browser process. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page hosted on an attacker-controlled server.

• AuthenticationNot required

  No account, session token, or credential of any kind is needed to serve the malicious page or trigger the vulnerability.

• Victim interactionRequired

  The targeted user must open the crafted HTML page in the affected browser, making this a social-engineering or drive-by scenario requiring at least one click or navigation action.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, memory layout randomization outcomes, or other variable environmental factors.

Blast Radius

• Reads browser memory contents, including stored session tokens, saved credentials, and cached page data belonging to the affected user.
• Writes to heap memory in the browser process, allowing an attacker to corrupt internal structures and potentially redirect code execution.
• Crashes the affected Chrome browser process on Linux, causing immediate loss of all open tabs and in-progress work for the user.
• Combines read and write primitives to achieve arbitrary code execution within the browser's renderer or GPU process security boundary.