CVE-2026-11115: Chrome Windows Use-After-Free Privilege Escalation Vulnerability

Technical summary

CVE-2026-11115 is a use-after-free vulnerability (CWE-416) in the Chrome Updater component running on Windows. The flaw allows a local, low-privileged attacker to achieve arbitrary code execution with elevated privileges. The vulnerability stems from improper memory management where a freed object is accessed after deallocation. Exploitation requires local code execution context and user action to complete the attack chain, but once triggered, the impact is complete system compromise.

Business impact

Successful exploitation enables a local attacker to elevate privileges and gain system-level control of affected Windows machines. For organizations, this poses a significant risk to endpoint security, particularly in multi-user or shared-device environments. An attacker could install malware, exfiltrate sensitive data, modify system configurations, or use the compromised system as a pivot point for lateral movement within corporate networks.

Affected systems

Google Chrome versions prior to 149.0.7827.53 running on Microsoft Windows systems are vulnerable. This includes consumer and enterprise deployments. The vulnerability requires local access, so the risk is highest on shared workstations, kiosks, or systems where non-administrative users can execute files or interact with the Chrome update process.

Exploitability

Exploitability is moderate. An attacker needs local system access and the ability to place or trigger a malicious file, plus user interaction to complete the attack. The vulnerability is not remotely exploitable and does not appear on the CISA KEV catalog, suggesting active exploitation in the wild has not been widely documented at the time of publication. However, the technical barrier to exploitation is relatively low once local access is established.

Remediation

Immediately update Google Chrome to version 149.0.7827.53 or later on all Windows systems. Verify the update deployment across your organization, especially on critical workstations and shared devices. Chrome's automatic update mechanism should deploy this patch, but forced distribution through enterprise policy is recommended to ensure full coverage.

Patch guidance

Deploy Chrome version 149.0.7827.53 or later. For enterprise environments, use Google Chrome's enterprise update policies or third-party patch management solutions to enforce the update. Verify successful patching by checking Chrome's 'About Chrome' page (chrome://settings/help) on affected systems. Test patches in a non-production environment first to confirm compatibility with any custom Chrome configurations or extensions your organization relies on.

Detection guidance

Monitor for execution of suspicious files in user-writable directories, particularly those that interact with the Chrome update mechanism. Track process creation events where the Chrome Updater (GoogleUpdate.exe or related processes) spawns unexpected child processes. Implement application whitelisting for update-related binaries. In Windows event logs, look for privilege escalation indicators following Chrome-related process activity. Advanced endpoint detection should flag anomalous memory access patterns in Chrome processes if behavioral monitoring is available.

Why prioritize this

This vulnerability merits high priority due to its HIGH CVSS score (7.3) and local privilege escalation impact. While it requires local access and user interaction, the consequences—complete system compromise—are severe. In endpoint-heavy organizations, the cumulative risk across many machines is substantial. The fact that it is not yet on the KEV catalog suggests a narrow window before active exploitation becomes widespread; early patching is prudent.

Risk score, explained

The CVSS v3.1 score of 7.3 reflects the high impact (confidentiality, integrity, and availability all compromised) balanced against the requirement for local access and low privileges. The attack vector is local (AV:L), attack complexity is low (AC:L), minimal privileges are needed (PR:L), user interaction is required (UI:R), and scope is unchanged (S:U). This combination yields a HIGH severity rating appropriate for a privilege escalation flaw on Windows endpoints.

Frequently asked questions