CVE-2026-11224: Use-After-Free in Chrome Chromoting on Linux (CVSS 8.1)

Technical summary

CVE-2026-11224 is a use-after-free vulnerability (CWE-416) in the Chromoting subsystem of Google Chrome on Linux. The flaw arises from improper memory management where code attempts to access memory that has already been freed, allowing a network-based attacker to trigger this condition and gain arbitrary code execution. The vulnerability requires network accessibility but no user interaction or elevated privileges. Chrome versions prior to 149.0.7827.53 on Linux are affected.

Business impact

Exploitation of this vulnerability could allow attackers to execute arbitrary code within the Chrome process context on Linux endpoints. For organizations relying on Chrome's remote desktop capabilities (Chromoting), this creates a pathway for remote compromise without requiring user awareness or interaction. The impact extends to confidentiality, integrity, and availability—attackers could steal sensitive data, modify systems, or disrupt operations. This is particularly concerning for users who access Chromoting across untrusted networks.

Affected systems

Google Chrome on Linux operating systems running versions prior to 149.0.7827.53. The Linux kernel itself is listed as an affected vendor product in the CVE record, though the primary vulnerability resides in Chrome's Chromoting implementation. Organizations should inventory Chrome installations on Linux servers and workstations, particularly those used for remote access scenarios or exposed to untrusted network segments.

Exploitability

Exploitation requires network access and the ability to send malicious network traffic to the target Chrome instance, likely during an active Chromoting session or against the Chromoting listener. The CVSS vector indicates high complexity (AC:H), suggesting specific conditions or race conditions may need to align, but the lack of required privileges or user interaction means the barrier to exploitation remains low for a motivated attacker. The vulnerability is not currently listed on the CISA KEV catalog, indicating no active weaponized exploits have been publicly disclosed and monitored at this time.

Remediation

Update Google Chrome on Linux systems to version 149.0.7827.53 or later. This release includes a patch that resolves the use-after-free condition in Chromoting. Verify the patch version against the official Google Chrome release notes and security advisory to confirm applicability. Organizations should prioritize this update for systems that actively use Chromoting or are exposed to untrusted networks.

Patch guidance

Deploy Chrome version 149.0.7827.53 or later across all Linux environments. For enterprise deployments, use Google's browser policy controls to enforce automatic updates or pushed deployment. Test the update in a pre-production environment first to ensure compatibility with any organization-specific extensions or configurations. Given the CVSS score of 8.1 and the network-based attack vector, prioritize this patch within 5–7 days of availability.

Detection guidance

Monitor for unexpected network connections to Chrome instances, particularly involving Chromoting ports or processes. Log and alert on Chrome process crashes or restarts that could indicate exploitation attempts. Inspect network traffic for anomalous patterns destined to Chromoting listeners. Host-based monitoring should capture use-after-free indicators such as memory corruption signatures or unusual Chrome process behavior. Review Chrome version inventory regularly to identify systems still running vulnerable versions.

Why prioritize this

This vulnerability merits urgent remediation due to its combination of high CVSS score (8.1), network-based attack vector (AV:N), and lack of required user interaction (UI:N). Although listed as Low severity by Chromium, the overall impact on confidentiality, integrity, and availability is substantial. Any system running Chromoting on Linux should be treated as a high-priority patch target to prevent remote code execution.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH severity) reflects the critical nature of arbitrary code execution achievable through network access without privileges or user interaction. The high complexity (AC:H) moderately reduces the likelihood of spontaneous exploitation but does not significantly lower the severity of successful compromise. The unchanged scope (S:U) and maximum impact across all three security dimensions (C:H/I:H/A:H) reinforce the urgent remediation priority.

Frequently asked questions