CVE-2026-11700: Use after free in Tracing in Google Chrome prior to 149

Synopsis

Use-after-free in the Tracing component of Google Chrome prior to version 149.0.7827.103 allows a remote attacker who has already compromised the renderer process to escape the browser sandbox via a crafted HTML page. The attacker reaches this vulnerability over the network and requires the victim to interact with a malicious page, but no authentication is needed. Successful exploitation gives the attacker full read, write, and execution capability outside the sandbox, effectively compromising the host. A patched-image rebuild at 149.0.7827.103 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim's browser over the network by serving a crafted HTML page from a remote origin.

• AuthenticationNot required

  No account or credential of any kind is required; the exploit is reachable by any unauthenticated visitor to the malicious page.

• Victim interactionRequired

  The victim must visit or be redirected to the attacker-controlled page, making social engineering or phishing a prerequisite.

• Attack complexityDetail

  Exploitation requires the renderer process to already be compromised before the use-after-free can be used for sandbox escape, introducing an additional prerequisite beyond delivering the crafted page.

Blast Radius

• An attacker who escapes the sandbox gains code execution in the context of the browser process on the host, outside Chrome's security boundary.
• Full confidentiality impact means the attacker reads arbitrary files, stored credentials, cookies, and session tokens accessible to the browser process.
• Full integrity impact means the attacker writes or modifies files and data on the host, including dropping persistent payloads.
• Full availability impact means the attacker can crash or terminate the browser process or other host processes it can reach.