CVE-2026-11136: Chrome Canvas Use-After-Free Remote Code Execution

Technical summary

CVE-2026-11136 is a use-after-free vulnerability (CWE-416) in Chrome's Canvas implementation. The flaw occurs when the Canvas component fails to properly manage object lifetime, allowing an attacker to reference memory that has already been freed. When exploited via a specially crafted HTML document, this memory corruption results in arbitrary code execution within the browser process sandbox. The Chromium security team assigned a Medium severity classification internally, though the CVSS 3.1 score of 8.8 (HIGH) reflects the combination of network-based attack vector, low complexity, no privilege requirement, and complete confidentiality, integrity, and availability impact.

Business impact

While the code execution occurs within the browser sandbox—which provides some containment—a successful exploit could allow attackers to steal sensitive data (credentials, browsing history, cached content), execute malware from compromised websites, or use compromised browsers as pivot points into corporate networks. Organizations with users browsing untrusted sites face elevated risk. The vulnerability's ease of exploitation (only requiring a webpage visit) and broad reach across Windows, macOS, and Linux platforms increase the potential attack surface significantly.

Affected systems

Google Chrome versions before 149.0.7827.53 are vulnerable. The vulnerability affects Chrome on Windows, macOS, and Linux. Related Chromium-based browsers may also be affected depending on their patch status. Organizations should verify the current Chrome version across their deployment and check whether their systems have auto-update enabled.

Exploitability

The vulnerability has a low barrier to exploitation: an attacker only needs to host a crafted HTML page and trick a user into visiting it—no advanced social engineering is required beyond standard phishing techniques. The attack surface is broad since nearly all users visit multiple websites daily. However, Chrome's sandbox architecture means the attacker gains code execution in a restricted context rather than direct system-level access. No public exploit has been added to the CISA Known Exploited Vulnerabilities catalog, but the relatively straightforward nature of use-after-free exploits in browser engines suggests attack code could be developed quickly.

Remediation

Update Google Chrome to version 149.0.7827.53 or later. Chrome's automatic update mechanism should deliver the patch within days; users can manually check for updates via Settings > About > Google Chrome. Organizations should confirm auto-updates are enabled in their Chrome deployment policy. Verify completion across managed endpoints before considering the vulnerability remediated. For Chromium-based browsers (Edge, Brave, Opera, etc.), check respective vendor advisories for patched versions.

Patch guidance

Patch Chrome to 149.0.7827.53 or a later stable release. Organizations can verify patched status via chrome://version/ or through enterprise management tools. If Chrome auto-update is enabled, no manual action is necessary beyond confirming deployment. For enterprises using Chrome on managed devices, push the update through your Mobile Device Management or system management platform. Priority should be given to machines where users frequently visit untrusted or user-generated content sites.

Detection guidance

Monitor Chrome version inventory to identify unpatched instances below 149.0.7827.53. Detection of active exploitation is difficult without access to crashed process dumps and memory debugging; however, watch for unexpected Chrome crashes, especially those correlated with specific website visits or email links. Enable Chrome crash reporting (CrashPad) if your organization has a managed enrollment, which aids forensic analysis. Network-level detection is limited since the exploit is delivered via standard HTTP/HTTPS traffic embedded in a webpage.

Why prioritize this

Though not yet listed on CISA's KEV catalog, the combination of high CVSS score (8.8), ease of exploitation, and ubiquity of Chrome across endpoints warrants rapid patching. The use-after-free class of vulnerability is well-understood in the security community and public exploit frameworks; weaponization risk is moderate-to-high even without known public exploits currently in the wild. User-facing attack surface (malicious websites) means defenders cannot fully control exposure without restricting browsing.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: attack vector of Network (users can be exploited by visiting any website), attack complexity of Low (no special conditions needed), privilege requirement of None (normal user can trigger it), user interaction of Required (the user must visit the malicious page), and complete impact on confidentiality, integrity, and availability within the sandbox context. While sandboxing limits blast radius, the ease of reaching users and completeness of impact within the browser process justifies the HIGH severity rating.

Frequently asked questions