CVE-2026-11055: Chrome ANGLE Use-After-Free Remote Code Execution on Windows

Technical summary

CVE-2026-11055 is a use-after-free flaw (CWE-416) in ANGLE, the graphics abstraction layer bundled with Chrome. Use-after-free vulnerabilities occur when freed memory is accessed again, potentially allowing an attacker to corrupt the heap or redirect execution. In this case, the flaw resides in ANGLE's rendering pipeline and can be triggered via crafted HTML and WebGL content served from a remote website. The vulnerability is exploitable in a network context without elevated privileges or special browser configuration. The sandboxed execution model provides a baseline defense, but the sandbox itself is the attack boundary—breakout techniques or subsequent privilege escalation would extend impact beyond process isolation.

Business impact

Organizations relying on Chrome for employee browsing face active compromise risk if users visit attacker-controlled or compromised websites. Financial services, media companies, and any sector where employee devices access untrusted content are exposed. Successful exploitation delivers arbitrary code execution within the Chrome process, enabling credential theft, malware installation, or lateral movement to internal systems. The requirement for user interaction (visiting a link) is a speed bump, not a barrier, given phishing and watering-hole attack prevalence. Delayed patching across a workforce materially increases intrusion surface.

Affected systems

Google Chrome on Microsoft Windows versions prior to 149.0.7827.53 are vulnerable. The fix is version-gated; Chrome on other operating systems (Linux, macOS) may have different patch versions—verify against Google's advisory. Enterprise deployments using Chrome with managed policies, as well as consumer users on unmanaged Windows systems, are in scope. Systems running Chrome 149.0.7827.53 or later are patched.

Exploitability

Exploitation requires only network access and user interaction (visiting a malicious or compromised website). No authentication, special permissions, or browser add-ins are needed. An attacker can host exploit-containing HTML on any accessible server or inject malicious scripts into legitimate sites via compromised infrastructure or supply-chain compromise. The barrier to weaponization is low; proof-of-concept code would likely circulate quickly among security researchers and threat actors. The vulnerability is currently not listed in CISA's Known Exploited Vulnerabilities catalog, but the recency of disclosure and the simplicity of triggering the flaw suggest active exploitation is a near-term risk.

Remediation

Update Google Chrome to version 149.0.7827.53 or later. Chrome's automatic update mechanism should deploy the patch within days; verify via Settings > About Chrome that the version string reflects the patched build. For enterprise environments, use Chrome Enterprise policies or Mobile Device Management (MDM) tools to enforce timely updates. Consider temporarily restricting browsing to whitelisted, trusted sites if immediate patching is infeasible. Testing should confirm no critical workflows are broken by the update before broad rollout.

Patch guidance

Patched version is Chrome 149.0.7827.53. Google typically releases patches on Tuesdays; consult the Google Chrome release notes and security advisories for the exact deployment date and any interim guidance. Enterprise administrators should test the patched version in a pilot group, then roll out via MDM or Group Policy to force installation. Users on non-enterprise systems should enable automatic updates (Chrome default) and restart the browser when prompted. Verify the update completed by opening chrome://version/ and confirming the build number is at least 149.0.7827.53 or higher.

Detection guidance

Monitor for Chrome process crashes or unexpected terminations on Windows systems, which may indicate exploitation attempts. Endpoint detection and response (EDR) tools should flag anomalous memory access patterns, heap spraying activity, or sandbox escape attempts originating from Chrome child processes. Network-level detection is limited because exploit delivery is via HTTP/HTTPS web traffic; focus on user behavior (unexpected visits to suspicious domains) and post-exploitation indicators (data exfiltration, lateral movement attempts). Check browser history and network logs for visits to known malicious sites during the window of exposure. In incident response, assume compromised Chrome processes could have spawned secondary malware or stolen cached credentials; preserve forensics and scan endpoints downstream.

Why prioritize this

This vulnerability merits immediate attention due to the combination of high CVSS score (8.8), low exploitation barriers (network access + user click), and realistic attack scenarios. Chrome's ubiquity in enterprise and consumer environments, coupled with the simplicity of delivering the exploit (any webpage), elevates risk. The lack of KEV listing does not imply low priority; it reflects the recency of disclosure. Organizations should treat this as critical-priority patching within 48–72 hours of patch release. Business units relying on unpatched systems for essential work should coordinate with IT for accelerated testing and deployment.

Risk score, explained

CVSS 8.8 (HIGH) is driven by network accessibility (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), and user interaction limited to following a link (UI:R). Impact ratings are high across confidentiality, integrity, and availability (C:H/I:H/A:H) because code execution within the Chrome process can steal data, modify files in the user's context, or crash the browser. The sandboxed execution scope (S:U, unchanged scope) prevents direct system-wide impact but does not reduce the risk to the individual user or their data. The score reflects a realistic, remotely triggerable threat with significant user harm potential.

Frequently asked questions