CVE-2026-11147: Chrome WebML Use-After-Free RCE on Windows

Technical summary

CVE-2026-11147 is a use-after-free memory safety flaw (CWE-416) in the WebML implementation within Google Chrome for Windows versions prior to 149.0.7827.53. The vulnerability arises when WebML fails to properly manage object lifetime, allowing memory to be freed and then accessed again during subsequent operations. A remote attacker can exploit this by hosting a specially crafted HTML page that triggers the use-after-free condition. Successful exploitation results in arbitrary code execution within the Chrome renderer sandbox. The attack requires user interaction (visiting the malicious page) but no special privileges or local access.

Business impact

Organizations where employees use Chrome on Windows face exposure to malware injection and data theft. Attackers can use this vulnerability to steal sensitive data from browser memory, inject malicious scripts into legitimate sites, or establish persistence for follow-on attacks. If exploited at scale via drive-by downloads or watering-hole attacks, this could compromise large user populations. Financial services, healthcare, and government sectors face particular risk due to the sensitivity of data typically accessed through browsers.

Affected systems

Google Chrome running on Windows versions prior to 149.0.7827.53 is vulnerable. Both consumer and enterprise deployments are affected. Linux and macOS Chrome installations are unaffected, as the vulnerability is specific to the Windows platform. The vulnerability affects all Chrome users until they update to version 149.0.7827.53 or later.

Exploitability

The attack surface is broad because it requires only that a user visit a malicious webpage—no social engineering beyond typical phishing tactics is necessary. The CVSS score of 8.8 reflects the combination of network accessibility, low attack complexity, and high impact (confidentiality, integrity, and availability). However, the vulnerability has not been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating that as of the publication date, active exploitation in the wild has not been confirmed. The sandbox containment partially mitigates impact, but escape is possible under certain conditions.

Remediation

Update Google Chrome to version 149.0.7827.53 or later on all Windows systems. Chrome's auto-update mechanism will typically deliver this patch automatically, but administrators should verify deployment completion. For enterprise environments, use Chrome policies to enforce minimum version requirements and disable user downgrades. Users on devices where auto-update is disabled must manually trigger the update.

Patch guidance

Verify that Chrome has updated to 149.0.7827.53 or later by checking Help > About Google Chrome, which will display the current version and update status. In managed environments, confirm via endpoint management tools (MDM/MDC) that all Chrome instances report version 149.0.7827.53 or higher. If auto-update is disabled, manually download and install the latest Chrome release from google.com/chrome. Test the patch on a non-critical system first to rule out compatibility issues with extensions or internal web applications.

Detection guidance

Monitor Windows event logs for Chrome renderer process crashes or abnormal termination, which may indicate exploitation attempts. Track Chrome version inventory across your fleet; any system running version 149.0.7827.0 through 149.0.7827.52 should be prioritized for patching. Network-level detection is limited because the attack occurs entirely within the browser; however, monitor outbound connections from Chrome processes to suspicious domains that may be hosting exploit pages. Endpoint detection and response (EDR) tools may flag unusual Chrome memory access patterns or child process creation.

Why prioritize this

Although Chromium assigned this a Medium severity rating, the CVSS score of 8.8 (HIGH) reflects realistic risk: network exploitability, low attack complexity, and impact across confidentiality, integrity, and availability. The lack of KEV listing suggests active exploitation is not yet widespread, providing a window to patch before threat actors weaponize this flaw. Prioritize patching for users in high-risk roles (finance, legal, research) and public-facing web applications that handle sensitive data. Standard deployment over the next 30 days is appropriate for the broader user base.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) is driven by: (1) Network Attack Vector—no local access required, (2) Low Attack Complexity—the vulnerability does not require special conditions or user knowledge beyond visiting a page, (3) No Privileges Required—the attacker needs no prior account or permissions, (4) User Interaction Required—reduces from Critical, as a user must visit the malicious page, (5) Sandbox Scope Unchanged—the vulnerability does not escape the sandbox by default, limiting the attack scope, yet (6) High Impact across all three security properties—arbitrary code execution in the renderer process can leak data, modify content, and disrupt service. The score appropriately reflects elevated risk within a partially contained environment.

Frequently asked questions