CVE-2026-11692: Use after free in Read Anything in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability exists in the Read Anything component of Google Chrome prior to version 149.0.7827.103. The flaw is reachable over the network and requires the attacker to have already compromised the renderer process, but no authentication is needed; the victim must open a crafted HTML page. Successful exploitation allows a renderer-level attacker to escape the Chrome sandbox, gaining the ability to read, modify, or disrupt data at the operating-system process level outside the browser's normal containment. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers a crafted HTML page over the network, so the affected Chrome instance must be reachable by or directed to attacker-controlled web content.

• AuthenticationNot required

  No account or credential is required; the attacker only needs to get the victim to load a crafted page.

• Victim interactionRequired

  The victim must actively open or be redirected to a crafted HTML page, making a social-engineering or malicious-link step necessary.

• Attack complexityDetail

  Attack complexity is High because the attacker must have already compromised the renderer process as a prerequisite before the sandbox-escape primitive becomes usable.

Blast Radius

• A successful attacker escapes the Chrome sandbox and executes code in the browser's host process, bypassing the primary isolation boundary protecting the underlying OS.
• Confidential data accessible to the Chrome process (stored credentials, cookies, session tokens, local files) becomes readable to the attacker.
• The attacker can write or modify files and data accessible to the user account running Chrome, including browser profile data and locally cached content.
• The attacker can crash or destabilize the Chrome process and any dependent services, causing denial of service at the application level.