CVE-2026-11143: Chrome Linux Extension Out-of-Bounds Read Memory Leak

Technical summary

CVE-2026-11143 is an out-of-bounds read (CWE-122) in Chrome's Extensions subsystem on Linux. The vulnerability permits a crafted extension to access memory regions outside its intended boundaries, potentially exfiltrating sensitive application state. The Chromium project assigned this a Medium security severity. The vector profile (CVSS 3.1: 6.5 Medium) reflects network-accessible attack surface, low complexity, no privilege requirement, and user interaction (extension installation) as the gating factor, with confidentiality impact as the primary concern.

Business impact

If exploited, this vulnerability enables credential theft and sensitive data exfiltration at scale. An attacker distributing a trojanized extension through official or third-party app stores could compromise user credentials, API keys, and session identifiers stored in Chrome's memory. For organizations where employees use Chrome with extensions for development, cloud access, or corporate collaboration tools, this represents a direct path to lateral movement and account compromise. The impact multiplies if the extension masquerades as a legitimate productivity tool.

Affected systems

Google Chrome on Linux running versions prior to 149.0.7827.53 are vulnerable. This includes all releases of Chrome, Chromium, and Chromium-based browsers (Edge, Brave, etc.) built from the affected Chromium codebase before the patch. The vulnerability is specific to Linux; Windows and macOS distributions were addressed separately. Any user who has installed a malicious extension remains at risk until both Chrome is updated and the extension is removed.

Exploitability

Exploitability requires successful social engineering to convince a user to install a malicious extension—a non-trivial hurdle in some environments but increasingly viable given the volume of extensions available and varying user security awareness. Once installed, exploitation is automatic and requires no further user action. The extension can silently exfiltrate memory contents on every page load or browser interaction. No authentication bypass or system privilege escalation is needed; the attack is entirely within the browser sandbox boundary.

Remediation

Update Google Chrome to version 149.0.7827.53 or later on all Linux systems. Concurrent with patching, audit installed extensions—particularly those from unfamiliar publishers, those requesting broad permissions, or those recently added to official stores. Users should verify extension legitimacy against official vendor documentation and consider disabling extensions not actively required. Organizations should enforce extension allow-lists via Chrome Enterprise Policies if browser centralized management is in place.

Patch guidance

Apply Chrome update 149.0.7827.53 (or later) via Settings > About Google Chrome on each Linux workstation; auto-update is the default for most deployments but should be verified in managed environments. Verify installation by navigating to chrome://version and confirming the version string. For Chromium-based browsers (Edge, Brave), apply the equivalent patched release from the respective vendor, as this flaw affects the shared Chromium codebase. Test in a lab environment first if deploying to critical systems to rule out extension compatibility issues.

Detection guidance

Monitor Chrome version strings across Linux endpoints using EDR or fleet management tools to identify systems still running pre-149.0.7827.53 releases. Log and alert on extension installation events, especially from unknown or low-reputation publishers. If available, inspect Chrome extension activity logs for unusual memory access patterns or unexpected data exfiltration. Network detection is difficult since the exfiltration occurs over normal HTTPS channels; focus on extension governance and version compliance. Correlate with user reports of unexpected credential resets or unauthorized account activity.

Why prioritize this

Although the CVSS score is Medium (6.5), the real-world risk is elevated by two factors: (1) ease of distribution through legitimate app stores with minimal verification, and (2) silent, non-detectable exploitation once the user installs the extension. Development and finance teams, where extensions are more commonly used for productivity and integrations, face disproportionate risk. The lack of KEV designation does not diminish urgency; in-the-wild exploitation is possible and social engineering is a known attack vector for extension deployment.

Risk score, explained

CVSS 3.1 base score of 6.5 (Medium) reflects: Attack Vector Network (installation can be prompted remotely), Attack Complexity Low (no special conditions needed), Privileges Required None (extension runs as user, not as elevated process), User Interaction Required (extension must be installed), Scope Unchanged, Confidentiality High (sensitive memory can be read), Integrity None, Availability None. The score appropriately penalizes the user interaction requirement but acknowledges the severity of unrestricted information disclosure once that hurdle is cleared.

Frequently asked questions