CVE-2026-11049: Google Chrome Password Manager Use-After-Free Vulnerability – Patch Required

Technical summary

CVE-2026-11049 is a use-after-free vulnerability (CWE-416) in the Password Manager component of Chromium-based browsers. The vulnerability allows memory that has been freed to be accessed again, leading to memory corruption. An attacker can craft an HTML page that triggers this condition when processed by Chrome's Password Manager subsystem. Successful exploitation results in arbitrary code execution within the Chrome sandbox environment. The sandbox provides a containment layer, but breakout techniques or chained vulnerabilities could escalate privileges. The issue requires user interaction (visiting a malicious page) but no special credentials or browser configuration.

Business impact

For organizations deploying Chrome as a standard browser, this vulnerability poses a material risk to endpoint security. An attacker could execute code within the sandbox to steal credentials stored in Chrome's Password Manager, harvest session tokens, exfiltrate browser cache data, or establish persistence. While the sandbox mitigates OS-level compromise, credential theft alone creates significant downstream risk, particularly in environments where password managers serve as a single point of trust for enterprise accounts. Delayed patching extends the window of exposure to targeted attacks or drive-by exploitation.

Affected systems

Google Chrome versions prior to 149.0.7827.53 are affected on Windows, macOS, and Linux operating systems. Any user or managed endpoint running an older build of Chrome with an active Password Manager is in scope. Organizations using Chromebook devices, Chrome Enterprise, or Chrome as part of a managed browser strategy should prioritize inventory of deployed versions.

Exploitability

Exploitation is feasible but not trivial. An attacker must author a crafted HTML page and deliver it to a target user—either through a compromised website, phishing email link, or watering hole attack. No zero-click mechanism is evident; user must navigate to the malicious page. Once visited, the vulnerability triggers automatically during normal Password Manager operation. The attack surface is broad (any website visit via Chrome) but the attack chain is not yet widely documented in public exploit databases. The lack of CISA KEV status as of this analysis suggests real-world exploitation has not reached organized ransomware or state-sponsored campaigns, though targeted attacks are possible.

Remediation

Update Google Chrome to version 149.0.7827.53 or later. On Windows, macOS, and Linux, Chrome's built-in auto-update mechanism will deliver patches automatically; however, verify the update has been applied under Settings > About Chrome. For managed enterprise deployments, push the patched version through your MDM or software deployment tool and verify rollout completion before considering this vulnerability closed. Users should not rely on manual update prompts alone.

Patch guidance

Google has released Chrome 149.0.7827.53 containing the fix. Verify the version after update by navigating to chrome://version in the address bar. For macOS users, ensure they restart Chrome fully after auto-update completes. Windows users may need to close all Chrome windows and relaunch. Linux users installing via package managers should pull the latest version from their distribution repository. Test in a pilot group to confirm no critical extensions or workflows break before full rollout. If you maintain a Chrome deployment manifest or policy, update minimum version policies to reflect 149.0.7827.53.

Detection guidance

Monitor for Chrome crashes or abnormal termination logs on endpoints, as exploitation may trigger sandbox violations. Look for unusual Password Manager access patterns in audit logs if your environment collects Chrome user activity. Network-level detection is limited without decryption, but blocking access to known malicious domains hosting exploit payloads provides some mitigation. Endpoint Detection and Response (EDR) tools should alert on suspicious child processes spawned from Chrome or unexpected memory access patterns. Conduct a vulnerability scan of your browser inventory to identify out-of-date Chrome instances.

Why prioritize this

This vulnerability merits immediate prioritization due to its high CVSS score (8.8), ease of exploitation via user interaction, and direct access to stored credentials. Although Chromium classifies it as medium severity, the combination of high confidentiality and integrity impact, lack of required privileges, and broad attack surface justify rapid patching. The absence from CISA's KEV list suggests a window of lower immediate threat activity, making this an optimal time to patch before threat actors widely weaponize it.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects: (1) network-based attack vector requiring only a crafted webpage, (2) low complexity with no special preconditions, (3) no required privileges or authentication, (4) user interaction necessity (visiting a page), (5) sandbox scope limiting OS impact, and (6) high impact on confidentiality, integrity, and availability within the sandbox context. The score appropriately weighs the real-world risk of credential theft and sandbox-escape potential against the containment provided by Chrome's isolation architecture.

Frequently asked questions