Loading vulnerability…
CVE-2026-11118 is a use-after-free vulnerability in the WebRTC component of Google Chrome affecting versions prior to 149.0.7827.53. The flaw arises from improper lifetime management of memory in WebRTC, allowing stale object references to be accessed after the underlying memory has been freed. A remote attacker can trigger the condition by causing a target to load a crafted HTML page, potentially leading to controlled memory corruption and arbitrary code execution within the Chrome renderer sandbox.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small Python proof-of-concept for an HTTP/2 Rapid Reset denial-of-service scenario labeled CVE-2026-11118. It contains two code files: a client-side exploit (exploit_http2_rapid_reset.py) and a simple vulnerable/demo HTTP/2 TLS server (http2_server_sim.py), plus a README and license. The exploit is not part of a larger framework. The main exploit capability is network-based protocol abuse over HTTP/2: it establishes a TLS connection to localhost:8443, initiates an HTTP/2 session using the Python h2 library, then loops 1000 times sending GET request headers on new stream IDs and immediately resetting each stream with RST_STREAM. This demonstrates the classic rapid-reset pattern where the attacker forces the server to allocate and process stream state without completing normal requests, potentially exhausting resources and degrading availability. The included server simulator binds to 0.0.0.0:8443, wraps the accepted socket with TLS using cert.pem/key.pem, and processes HTTP/2 events. On RequestReceived events it resets the stream, illustrating reset handling behavior. The README explains how to generate self-signed certificates and run both components. There is no post-exploitation payload, persistence, or remote code execution logic. The repository’s purpose is purely to demonstrate a denial-of-service condition against HTTP/2 implementations that inadequately rate-limit or account for stream resets.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.