CVE-2026-12011: Use after free in WebMIDI in Google Chrome on Windows prior to 149

Synopsis

Use-after-free vulnerability in the WebMIDI component of Google Chrome on Windows affects versions prior to 149.0.7827.115. The flaw is reachable over the network and requires no authentication, but does require a victim to visit a crafted HTML page, and exploiting it also requires the attacker to have already compromised the Chrome renderer process. Successful exploitation enables a full sandbox escape, giving the attacker high-impact read, write, and availability control outside the browser sandbox. A patched-image rebuild at version 149.0.7827.115 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, requiring the victim's browser to reach or be directed to attacker-controlled content.

• AuthenticationNot required

  No credentials or account access are needed; the attack is launched against any unauthenticated user who visits the page.

• Victim interactionRequired

  The victim must visit a crafted HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Exploitation is rated high complexity because the attacker must first compromise the Chrome renderer process before the use-after-free can be leveraged for a sandbox escape.

Blast Radius

• Attacker escapes the Chrome sandbox and executes arbitrary code in the context of the browser process on the host Windows system.
• Confidential data accessible to the browser process, including stored credentials, cookies, and session tokens, is exposed to the attacker.
• The attacker can write or modify files and system state accessible to the browser process user account.
• The browser process and dependent services can be crashed or made unavailable.