CVE-2026-11201: Chrome ServiceWorker Use-After-Free RCE – Patch Guide

Technical summary

CVE-2026-11201 is a use-after-free memory vulnerability (CWE-416) in Google Chrome's ServiceWorker implementation. The flaw exists in versions before 149.0.7827.53 across Windows, macOS, and Linux. An attacker can craft a malicious Chrome extension that, once installed by a user, triggers the use-after-free condition in the ServiceWorker code path. This causes memory that has already been freed to be accessed and potentially overwritten, enabling arbitrary code execution within the browser context. The CVSS 3.1 score of 8.8 (HIGH) reflects the combination of network attack surface, low complexity, and the ability to compromise confidentiality, integrity, and availability without privilege escalation.

Business impact

Organizations permitting Chrome extensions in their environment face elevated risk. A targeted campaign distributing a malicious extension could compromise endpoints at scale if users are persuaded to install it. This could lead to data exfiltration, malware installation, credential theft, or lateral movement. The reliance on user action (extension installation) provides some friction, but phishing campaigns and social engineering can be effective at scale. Companies should audit their extension policies and monitor for suspicious extension installations.

Affected systems

Google Chrome prior to version 149.0.7827.53 on any operating system is vulnerable. The vulnerability affects Chrome on Windows, macOS, and Linux systems. Any user with an installed version below the patched release is at risk if they install a malicious extension. Organizations using Chrome as their standard browser should prioritize updating all endpoints to version 149.0.7827.53 or later.

Exploitability

Exploitation requires social engineering—convincing a user to install a malicious extension. Once the extension is installed, the use-after-free can be reliably triggered by the attacker's code within the extension context. The vulnerability is not remotely exploitable without user interaction; there is no wormable vector. However, targeted email campaigns, fake download sites, or app store manipulation could serve as delivery mechanisms. The medium Chromium severity designation likely reflects the user interaction requirement, though the CVSS scoring weights the impact severity more heavily.

Remediation

Update Google Chrome to version 149.0.7827.53 or later on all affected systems. Chrome's auto-update mechanism should handle this deployment for most users, but verify completion in high-security environments. Additionally, restrict or audit Chrome extension permissions through group policy (Windows) or Mobile Device Management (MDM) solutions. Disable the ability for users to install extensions from sources outside the official Chrome Web Store, and maintain a whitelist of approved extensions where feasible.

Patch guidance

Verify that Chrome has auto-updated to version 149.0.7827.53 or later by checking Settings > About Google Chrome on each affected system. For enterprise deployments, use Chrome Enterprise policies to enforce version updates and extension restrictions. Test patches in a staging environment before broad rollout to ensure compatibility with internal web applications and extensions. Consider scheduling updates during maintenance windows to minimize disruption.

Detection guidance

Monitor for installation of unusual or unsigned Chrome extensions, particularly those requesting broad permissions or coming from non-standard sources. Review Chrome extension audit logs via Chrome Sync or Enterprise reporting tools. Network detection should flag communications from Chrome processes to unexpected external hosts that could indicate extension-based exfiltration. Endpoint Detection and Response (EDR) tools should track suspicious process creation and memory access patterns originating from Chrome child processes.

Why prioritize this

Although the vulnerability requires user interaction, the severity of potential impact (arbitrary code execution) and the breadth of affected platforms warrant prompt patching. The use-after-free in ServiceWorker is a well-understood memory safety class of bug with reliable exploitation. Organizations should prioritize this update within their standard patch cycle, treating it as HIGH priority for devices handling sensitive data or used by high-value targets.

Risk score, explained

The CVSS 8.8 score reflects high impact (confidentiality, integrity, and availability all compromised) with low attack complexity and no special privileges required. The user interaction requirement (UI:R) prevents a score of 9.0 or higher, but does not reduce the severity materially given that social engineering is an effective attack vector. The network vector (AV:N) accounts for the remote delivery of the malicious extension payload.

Frequently asked questions