CVE-2026-11694: Use after free in ServiceWorker in Google Chrome prior to 149

Synopsis

Use-after-free vulnerability in the ServiceWorker component of Google Chrome (versions prior to 149.0.7827.103) allows a remote attacker who has already compromised the renderer process to execute arbitrary code inside the browser sandbox via a crafted HTML page. The attack is reachable over the network but requires victim interaction and carries high attack complexity due to the renderer pre-compromise prerequisite. Successful exploitation gives the attacker code execution within the sandbox, with full confidentiality, integrity, and availability impact on the affected process. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the target Chrome instance must be reachable and able to load attacker-controlled content.

• AuthenticationNot required

  No account or credential is needed to deliver the crafted HTML page that triggers the vulnerability.

• Victim interactionRequired

  A user must visit or be directed to a crafted HTML page, making social engineering or malicious-ad delivery a necessary step in the attack chain.

• Attack complexityDetail

  Attack complexity is high because the attacker must first compromise the Chrome renderer process before the use-after-free primitive can be leveraged for sandbox code execution.

Blast Radius

• Executes arbitrary code inside the Chrome sandbox process, giving the attacker full control over that process's execution context.
• Reads any data the renderer process can access, including page content, stored credentials surfaced by autofill, and in-memory session tokens.
• Modifies or tampers with page content and renderer state, enabling silent alteration of what the victim sees or submits.
• Crashes or destabilizes the affected browser process, disrupting the user's session and any dependent browser-hosted workloads.