CVE-2026-11683: Use after free in WebCodecs in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in the WebCodecs component of Google Chrome prior to version 149.0.7827.103 allows a remote attacker to execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The flaw is reachable over the network and requires no authentication, but does require the victim to visit or interact with a malicious page. Successful exploitation gives the attacker code execution within the Chrome sandbox, which can serve as a stepping stone to further privilege escalation. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the target browser must be able to reach and load the attacker-controlled HTML page.

• AuthenticationNot required

  No account or credential on the target system is needed; any unauthenticated remote attacker can attempt the exploit.

• Victim interactionRequired

  The victim must visit or be redirected to a crafted HTML page, making this a social-engineering or drive-by-delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other unpredictable environmental factors.

Blast Radius

• Reads sensitive data accessible within the Chrome renderer process, including page content, stored credentials surfaced by autofill, and in-memory session tokens.
• Modifies in-process state within the renderer, allowing the attacker to tamper with page content or inject follow-on payloads.
• Crashes or destabilizes the affected renderer process, causing loss of the current browsing session and any unsaved user data in that context.
• Establishes a foothold inside the Chrome sandbox that can be chained with a separate sandbox-escape bug to gain broader host-level access.