CVE-2026-11140: Chrome Chromecast Out-of-Bounds Read Memory Disclosure

Technical summary

CVE-2026-11140 is an out-of-bounds read vulnerability in the Chromecast implementation within Google Chrome prior to version 149.0.7827.53. The flaw permits a threat actor controlling a compromised renderer process to read adjacent memory regions via a maliciously crafted HTML page, potentially exposing sensitive process memory content. The vulnerability is classified as a bounds-checking failure (CWE-20) and carries a CVSS 3.1 score of 6.5 (Medium severity) with a network attack vector, low attack complexity, and confidentiality impact but no integrity or availability impact.

Business impact

This vulnerability primarily affects confidentiality. If an attacker gains renderer-process access—typically through a separate browser exploit or social engineering—they can pivot to extract sensitive data such as authentication tokens, cached credentials, personal information, or other in-memory secrets. For organizations, this means a single compromise of the browser process can lead to further data theft. End-users running unpatched Chrome versions face exposure if they visit malicious sites after their browser has been compromised through other means.

Affected systems

Google Chrome versions prior to 149.0.7827.53 are affected. Chrome runs on Windows, macOS, and Linux; the vulnerability affects all these platforms. Users of Chromium-based browsers that incorporate the affected code may also be vulnerable; organizations should verify their derivative browser versions against the upstream Chromium fix.

Exploitability

Exploitation requires two conditions: the attacker must have already compromised the renderer process (a non-trivial prerequisite), and the user must then visit a page controlled by the attacker. Once the renderer is compromised, triggering the vulnerability is straightforward via a crafted HTML page. The vulnerability is not currently tracked in the Known Exploited Vulnerabilities (KEV) catalog, meaning no widespread in-the-wild exploitation has been documented at the time of publication.

Remediation

Apply Chrome updates to version 149.0.7827.53 or later. Most users with automatic updates enabled will receive this patch without intervention. Organizations using managed Chrome deployments should verify patch deployment across their fleet. No workarounds exist for this class of vulnerability; patching is the only mitigation.

Patch guidance

Update Google Chrome to version 149.0.7827.53 or later via Settings > About Chrome, which will automatically download and apply the patch on restart. For enterprise environments using Google Chrome Enterprise, deploy updates through your device management console or verify that auto-update policies are enabled. Verify patch deployment by checking chrome://settings/help to confirm your installed version matches or exceeds 149.0.7827.53.

Detection guidance

Because exploitation requires prior renderer compromise, detection should focus on anomalous renderer process behavior and unusual memory access patterns. Monitor for browser exploitation attempts, unexpected child processes spawned by the Chrome renderer, or suspicious network activity following browser events. Endpoint detection and response (EDR) tools should flag unexpected memory reads from Chrome processes if the vendor provides such fidelity. Log and alert on installation of browser extensions from untrusted sources, as these are common initial compromise vectors.

Why prioritize this

Although the CVSS score is moderate (6.5), this vulnerability should be prioritized because it enables multi-stage attacks. An attacker exploiting this flaw gains access to sensitive in-memory data after achieving renderer compromise, raising the overall risk profile. The prevalence of Chrome usage and the open nature of web browsing mean a large installed base is at risk. However, the requirement for prior renderer compromise prevents this from being a zero-trust threat; it is a secondary vulnerability in an attack chain.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) reflects a network attack vector and low attack complexity, but zero integrity and availability impact—only confidentiality is affected. The score is appropriate for a memory disclosure flaw that requires user interaction (visiting a malicious page) after renderer compromise. From a real-world risk perspective, organizations with strong browser security controls and patch management can reduce exposure significantly, while those with poor patching discipline face elevated secondary-compromise risk.

Frequently asked questions