CVE-2026-11102: Chrome Isolated Web Apps Code Execution Vulnerability

Technical summary

CVE-2026-11102 is an implementation defect in Chrome's Isolated Web Apps feature that violates the principle of least privilege (CWE-474). The vulnerability exists in versions prior to 149.0.7827.53 and permits arbitrary code execution within the sandbox boundary. The attack vector is network-based with low attack complexity; user interaction is required to deliver the malicious file. The CVSS 3.1 vector (8.8 HIGH) reflects confidentiality, integrity, and availability impacts within the sandbox scope. Despite Chromium's internal severity rating of Medium, the CVSS assessment reflects the broad exploitability and high impact of arbitrary code execution, even in a constrained context.

Business impact

Organizations relying on Isolated Web Apps for running untrusted or third-party web content face immediate risk. If an attacker tricks users into opening a malicious file, the attacker gains code execution within the app's isolated context, potentially exposing data processed by that app or using it as a foothold for further attacks. For enterprises deploying Chrome-based workflows or distributing Isolated Web Apps internally, this vulnerability could disrupt business processes and compromise confidentiality of user data handled by affected applications.

Affected systems

All Google Chrome installations prior to version 149.0.7827.53 are affected. The vulnerability is specific to the Isolated Web Apps feature; standard web browsing and other Chrome features are not directly impacted by this particular flaw. Users running Chrome 149.0.7827.53 or later are protected. Mobile and desktop versions of Chrome are both in scope.

Exploitability

Exploitation requires a remote attacker to craft a malicious file and convince a user to open it within an Isolated Web App context. No authentication or elevated privileges are needed. The low attack complexity and network-accessible attack vector make this practical for attackers to exploit at scale. However, the requirement for user interaction—opening the file—provides a friction point that limits fully autonomous exploitation. Current public exploit code or active exploitation in the wild has not been reported, and this CVE is not yet on the CISA KEV catalog.

Remediation

Users should immediately update Google Chrome to version 149.0.7827.53 or later. The update patches the implementation flaw in Isolated Web Apps. Organizations should prioritize this update for endpoints running Isolated Web Apps or for users who regularly interact with untrusted web content. Verify successful updates by checking Chrome's version in Settings > About Chrome, which will auto-update and confirm the patch level.

Patch guidance

Apply Chrome version 149.0.7827.53 or any subsequent stable release. Chrome typically auto-updates, but users can manually check by navigating to Settings > About Chrome. Organizations with managed Chrome deployments should use their administrative console to force update policies if auto-update is delayed. Test the update on a subset of endpoints before broad rollout to confirm compatibility with any custom Isolated Web Apps or extensions.

Detection guidance

Monitor Chrome crash logs and sandbox escape attempts, though the vulnerability itself does not leave obvious network-level signatures. Organizations using endpoint detection and response (EDR) tools should look for unusual child process spawning or file access patterns from Chrome sandbox processes. If Isolated Web Apps are deployed internally, review recent user activity logs to identify if any users opened suspicious files within those apps. Network-based detection is limited since the attack is file-driven; focus detection efforts on host-based indicators and user behavior anomalies.

Why prioritize this

Although CISA has not yet added this to the KEV catalog and active exploitation is not widespread, the combination of high CVSS score (8.8), arbitrary code execution capability, low attack complexity, and the requirement for user interaction rather than network-level delivery makes this a near-term priority. Any organization using Isolated Web Apps or allowing users to open files within Chrome should patch within 1–2 weeks. General Chrome users with standard browsing habits should patch within 30 days, but those handling sensitive data or running custom web apps should prioritize sooner.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects that while the attack requires user interaction, successful exploitation grants arbitrary code execution with confidentiality, integrity, and availability impacts. The scope is unchanged (within the sandbox), which caps the score below 9.0, but the ease of attack delivery and the power granted to the attacker justify the HIGH severity. This assessment is more alarming than Chromium's internal Medium severity rating, likely because CVSS weighs real-world exploitability and impact more heavily than internal engineering classifications.

Frequently asked questions