CVE-2026-11000: Chrome Font Use-After-Free Remote Code Execution on Linux

Technical summary

CVE-2026-11000 is a use-after-free condition (CWE-416) in Chrome's font rendering subsystem on Linux platforms. The flaw allows an attacker to craft malicious HTML that, when processed by the browser, causes the font handler to reference memory that has already been freed. This memory safety error can be exploited to achieve arbitrary code execution within the Chrome sandbox context. The sandbox isolation means the initial breach is contained to the Chrome process, though sandbox escapes remain a secondary concern for defense-in-depth planning.

Business impact

Successful exploitation could allow attackers to steal sensitive data from users' browsing sessions, inject malware, or establish persistent access to systems. Organizations with Linux-based developer workstations, security researchers, or users on Linux desktops face elevated risk. The requirement for user interaction (visiting a malicious site) makes this suitable for targeted phishing campaigns or watering hole attacks against specific user communities.

Affected systems

Google Chrome on Linux is directly affected in all versions prior to 149.0.7827.53. The vulnerability does not affect Chrome on Windows or macOS based on the vendor advisory scope. Linux kernel itself is listed in the affected products dataset but the vulnerability is specific to Chrome's font handling, not the kernel. Organizations should verify their Chrome version and Linux distribution status against the official Chrome release notes.

Exploitability

The attack requires user interaction and network access but no authentication or elevated privileges. An attacker needs only to craft a malicious HTML page and lure a user to visit it—via email, compromised website, or other social engineering vectors. The fact that code execution occurs within a sandbox limits post-exploitation reach but does not eliminate the threat; sandbox bypasses and secondary payloads remain feasible attack paths. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, suggesting active in-the-wild exploitation has not been widely documented as of the advisory date.

Remediation

Update Google Chrome to version 149.0.7827.53 or later. The update is available through Chrome's automatic update mechanism; users can manually verify their version via chrome://settings/help. For organizations managing Chrome deployments, ensure patch deployment policies trigger promptly upon release. Linux administrators should also confirm their distributions have provided any supplementary security updates, though the primary remediation is the Chrome version upgrade.

Patch guidance

Verify that Google Chrome updates automatically on your systems, or manually trigger updates via Settings > About Google Chrome > Check for Updates. Confirm successful patching by checking chrome://version and verifying the version number is 149.0.7827.53 or higher. For enterprise deployments, use Chrome's device management policy to enforce minimum version requirements and track rollout progress. Test the patch in a non-production environment if your organization has critical web applications that depend on specific Chrome versions.

Detection guidance

Monitor Chrome version inventory across your fleet to identify systems running versions prior to 149.0.7827.53. Endpoint detection and response (EDR) tools should monitor for unusual font-handling processes or memory access patterns, though detection at exploitation time is challenging due to sandbox containment. Network-level detection is limited; focus instead on preventing user access to known malicious domains via threat intelligence feeds and DNS filtering. Log authentication attempts and data exfiltration from compromised user sessions if breach is suspected.

Why prioritize this

This vulnerability merits high priority due to its network-reachable attack surface, high CVSS score (8.8), and potential for arbitrary code execution. Although sandboxing limits immediate damage, the requirement for only user interaction and no privileges makes it suitable for large-scale phishing campaigns. Organizations should prioritize patching systems used by high-value targets (executives, engineers, researchers) and those with browsing access to untrusted content. The absence of active public exploitation in KEV does not reduce urgency; it reflects a lag in threat intelligence rather than actual risk.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH severity) reflects a network-reachable attack vector, low attack complexity, and no privilege requirements, balanced against the requirement for user interaction and the sandbox containment. Confidentiality, integrity, and availability impacts are all rated as high because successful exploitation allows arbitrary code execution within the user's browsing context, enabling data theft, malware installation, or denial of service. The sandbox does not reduce the CVSS score but is an important secondary control for defense depth.

Frequently asked questions