CVE-2026-11160: Chrome Linux Out-of-Bounds Memory Read Vulnerability

Technical summary

CVE-2026-11160 is an out-of-bounds read vulnerability (CWE-125) in Chrome's Input subsystem on Linux. The flaw allows an unauthenticated remote attacker to read memory outside the intended bounds of a buffer, potentially exposing sensitive process memory. The attack vector is network-based with low complexity; it requires user interaction to visit a malicious HTML page. The vulnerability has a CVSS 3.1 score of 6.5 (Medium severity) with high confidentiality impact but no integrity or availability impact. Chromium classified this as Medium severity internally.

Business impact

This vulnerability could enable attackers to harvest sensitive data from Chrome users on Linux, including authentication credentials, personal information, or session data. The requirement for user interaction limits the scope of mass exploitation, but targeted phishing campaigns could be effective. Organizations with significant Linux-based workforces relying on Chrome for web access face elevated risk of credential compromise and subsequent lateral movement. The confidentiality breach risk justifies prompt patching to prevent data exfiltration attacks.

Affected systems

Google Chrome on Linux operating systems running versions prior to 149.0.7827.53 are vulnerable. Windows and macOS versions of Chrome are not affected by this particular flaw. Linux system administrators and individual Linux users using Chrome should verify their installed version and apply the update. Other Chromium-based browsers on Linux may warrant separate evaluation depending on their patch status.

Exploitability

Exploitation requires delivering a crafted HTML page to a user and obtaining their interaction (visiting the page in Chrome). No authentication, elevated privileges, or complex conditions are needed on the attacker side, making the attack straightforward once the user is redirected or socially engineered. The low attack complexity and network vector indicate moderate real-world exploitability. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog as of the latest data, suggesting active exploitation in the wild has not yet been formally documented, though this does not rule out targeted or limited attacks.

Remediation

Update Google Chrome on Linux systems to version 149.0.7827.53 or later. Chrome typically auto-updates on most Linux distributions, but users should verify completion by checking Settings > About Google Chrome. For enterprise environments, administrators should deploy the update through their standard patch management processes and confirm rollout across all Linux workstations. No workarounds are available; patching is the required mitigation.

Patch guidance

Chrome users on Linux should update to version 149.0.7827.53 or later as soon as possible. Most users will receive updates automatically; check chrome://settings/help to trigger a manual check and restart. For managed deployments, verify that auto-update policies are enabled or use your configuration management tooling to push the new version. Test the patch in a non-production environment first if your organization requires validation before broad rollout.

Detection guidance

Monitor for Chrome processes accessing memory regions outside normal bounds by reviewing kernel logs or endpoint detection systems for out-of-bounds memory access patterns. Network teams should watch for POST/GET requests to suspicious or newly registered domains combined with Chrome user sessions. Endpoint Detection and Response (EDR) tools can flag processes attempting to read sensitive memory. Log user browsing history for visits to unfamiliar or malicious sites around the time credential compromise is suspected. Monitor for unusual authentication attempts or session abuse following potential exposure.

Why prioritize this

Although classified as Medium severity with a CVSS score of 6.5, the high confidentiality impact and ease of exploitation warrant prioritization for Linux environments. The attack requires only user interaction and a network connection, making it a realistic threat in phishing and malware distribution campaigns. The lack of KEV designation suggests this is not yet a widespread, documented threat, providing a window to patch before adversaries mature exploitation techniques. Prioritize based on your organization's Linux Chrome user population and sensitivity of data accessible through browser sessions.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a Medium severity rating driven by high confidentiality impact (C:H), no integrity or availability impact (I:N, A:N), low attack complexity (AC:L), and network attack vector (AV:N). The requirement for user interaction (UI:R) prevents a higher score. The Medium severity from Chromium aligns with this calculation. Organizations should treat this as a timely but not emergency patch, though the data exfiltration risk elevates it above purely informational issues.

Frequently asked questions