CVE-2026-11028: Chrome Media Use-After-Free Code Execution (8.8 HIGH)

Technical summary

CVE-2026-11028 is a use-after-free (CWE-416) in the Media component of Chromium affecting Chrome versions prior to 149.0.7827.53 on Linux and ChromeOS. The vulnerability allows code execution within the renderer sandbox via a specially crafted HTML page, contingent on the renderer process already being compromised. The attack vector is network-based and requires user interaction to load the malicious page. CVSS v3.1 score is 8.8 (HIGH), reflecting high confidentiality, integrity, and availability impact in the context of an already-compromised renderer.

Business impact

Organizations running Chrome or ChromeOS internally face elevated risk if users visit untrusted sites, as a two-stage attack (initial renderer compromise, then code execution via this flaw) could lead to full process compromise. While sandboxing limits OS-level damage, sensitive data within the browser profile—cached credentials, session tokens, browsing history—becomes accessible. For enterprises relying on Chrome for development tools or sensitive workflows, this represents a material increase in endpoint risk. Prompt patching is essential to close the window between renderer compromise and exploit.

Affected systems

Google Chrome, Google ChromeOS, and Linux systems running Chrome prior to version 149.0.7827.53 are affected. The vulnerability is specific to the Media subsystem and manifests only on Linux and ChromeOS; Windows and macOS Chrome builds are not listed as vulnerable. Any organization with Chrome deployments in these environments should inventory affected instances.

Exploitability

Exploitation requires two preconditions: first, the attacker must compromise the Chrome renderer process through a separate vulnerability or supply-chain attack; second, the user must then visit a page hosting the crafted HTML. The renderer sandbox itself remains intact post-exploitation, limiting lateral movement and OS access. Real-world attack likelihood is moderate—it is a useful post-compromise technique but not an entry vector on its own. The CVSS vector (AV:N/AC:L/PR:N/UI:R) reflects these realistic constraints; the HIGH score reflects the severity once both conditions are met.

Remediation

Update Google Chrome to version 149.0.7827.53 or later on all Linux and ChromeOS systems. ChromeOS systems can be configured for automatic updates; verify that auto-update is enabled and that devices have checked in recently. Linux users and enterprise Chrome deployments should prioritize this patch in their standard release cycle. Once patched, the use-after-free is mitigated.

Patch guidance

Verify the installed Chrome version via chrome://version (or Settings > About Chrome on ChromeOS). Compare against the fixed version 149.0.7827.53. For enterprise deployments, test the patch in a staging environment before rolling out. ChromeOS devices will typically auto-update within hours or days of the patch release; administrators can force update checks via device policy (Update > Check for updates). Linux users should install from their package manager or update via Chrome's built-in auto-update mechanism (Preferences > About). No special configuration is required post-patch.

Detection guidance

Monitor browser crash logs and renderer process restarts, which may indicate exploitation attempts. Network indicators are limited; inspect proxy or firewall logs for suspicious HTML delivery to Chrome instances (though this would typically be after renderer compromise). Endpoint detection and response (EDR) tools should flag unexpected code execution within sandboxed Chrome renderer contexts or abnormal system calls. Use Chrome Policy to require Safe Browsing on Extended Reporting to surface threat intelligence about known malicious pages. Consider user-facing warnings if your organization receives reports of unusual Chrome instability or memory usage.

Why prioritize this

Despite Chromium's own 'Medium' severity designation, the CVSS 8.8 HIGH score and the direct availability of a concrete attack path (HTML page delivery to already-compromised renderer) warrant urgent treatment. This is not a speculative or theoretical flaw. The post-compromise stage of the attack is reliable, and the impact (full code execution within the browser) is substantial. Organizations should patch within their standard critical-patch window, typically 24–72 hours for browser updates.

Risk score, explained

CVSS 8.8 reflects a network-accessible vulnerability with low attack complexity and user interaction required (visiting the malicious page). The High severity across confidentiality, integrity, and availability captures the realistic impact: once exploited within an already-compromised renderer, the attacker gains full capability to read, modify, or corrupt browser state and user data. The fact that exploitation requires prior renderer compromise does lower absolute risk relative to a primary entry point, but the CVSS scoring appropriately reflects the severity of the secondary stage.

Frequently asked questions