CVE-2026-11164: High-Severity Use-After-Free in Chrome Blink Engine

Technical summary

CVE-2026-11164 is a use-after-free vulnerability (CWE-416) in the Blink rendering engine. The flaw allows a remote attacker to trigger access to freed memory through a specially crafted HTML document. When a user visits the malicious page, the vulnerability enables arbitrary code execution within Chrome's sandbox isolation layer. The attack vector is network-based with low complexity and requires only user interaction (viewing the page). The CVSS 3.1 score of 8.8 (HIGH) reflects high impact across confidentiality, integrity, and availability.

Business impact

Exploitation allows attackers to run arbitrary code within the Chrome sandbox, which can lead to credential theft, sensitive data exfiltration, malware installation, or lateral movement to other systems on the network. The attack is reliable and requires only that a user visit a malicious webpage—no special user actions beyond normal browsing are needed. Organizations should prioritize patching to prevent potential data breaches, intellectual property theft, or endpoint compromise.

Affected systems

Google Chrome prior to version 149.0.7827.53 is directly affected. The vulnerability also impacts the operating systems Chrome runs on: Windows, macOS, and Linux distributions. Any user running an outdated Chrome build faces exposure. Organizations supporting multiple operating systems should ensure uniform patching across all platforms.

Exploitability

Exploitability is high. The attack requires only network access and user interaction (clicking or being redirected to a malicious URL), both of which are easily achievable at scale. The low complexity and lack of privilege requirements mean attackers need minimal resources to craft and distribute exploit pages. However, the sandboxed execution environment provides some containment—code runs within Chrome's isolation boundaries, limiting direct OS-level impact unless additional sandbox escape techniques are chained.

Remediation

Update Google Chrome to version 149.0.7827.53 or later. Check chrome://settings/help to verify your current version; Chrome will auto-download updates and prompt for restart. For managed environments, deploy version 149.0.7827.53 or newer through your organization's software distribution mechanism. Verify that auto-updates are enabled or enforce manual updates across endpoints. No workarounds exist; patching is the only effective mitigation.

Patch guidance

Verify your Chrome version at chrome://settings/help. If running a version prior to 149.0.7827.53, immediately update. Chrome typically auto-updates, but you may need to restart the browser to finalize the patch. For enterprises, consult Google's official Chrome release notes and your patch management policy. Test the patch on representative systems before broad rollout to confirm compatibility with your environment. Apple macOS and Linux distributions should verify that their packaged Chrome versions are synchronized with Google's 149.0.7827.53 release.

Detection guidance

Monitor for Chrome processes consuming unusual memory or exhibiting instability after viewing untrusted content. Web proxy logs may reveal attempts to redirect users to exploit pages; flag HTML files with suspicious JavaScript patterns targeting Blink-specific objects or memory manipulation. Endpoint detection and response (EDR) solutions should flag unexpected child process execution from Chrome, particularly if writing to sensitive directories. Check Chrome crash reports and browser logs for segmentation faults or out-of-bounds memory access signatures. Verify that Chrome updates have been applied across all systems using your asset inventory and patch compliance tools.

Why prioritize this

This vulnerability merits urgent patching. The CVSS score of 8.8 reflects high severity, and the attack is trivial to execute—no special user sophistication required. While sandboxing provides some defense-in-depth, successful exploitation still grants code execution on the victim's endpoint. The widespread use of Chrome and the ease of weaponizing malicious web pages mean attackers will likely develop and distribute exploit pages quickly. Organizations should treat this as a critical priority and patch within days, not weeks.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects: network-based attack vector (AV:N) with low complexity (AC:L), no privilege requirements (PR:N), and minimal user interaction (UI:R). The impact across confidentiality, integrity, and availability (C:H, I:H, A:H) is severe—successful exploitation grants arbitrary code execution. The CVSS severity aligns with the real-world risk: ease of attack delivery, high likelihood of user interaction, and direct code execution capability. Chromium's security team rated this as Medium severity internally, but the CVSS reflects a more comprehensive threat model accounting for widespread user base and exploitation simplicity.

Frequently asked questions