CVE-2026-11628: Chrome Use-After-Free in Ozone (Local Heap Corruption)

Technical summary

CVE-2026-11628 is a use-after-free vulnerability (CWE-416) in Chrome's Ozone display server abstraction layer. The flaw allows a local attacker with physical access to the device to cause heap corruption through a carefully crafted interaction. Ozone abstracts platform-specific windowing and graphics APIs, and the vulnerability suggests improper memory lifecycle management in this component. The attack requires no user interaction or elevated privileges, but does mandate physical presence at the target machine.

Business impact

For most enterprise environments, the physical access requirement significantly reduces exploitability risk. However, organizations with unattended public kiosks, shared laboratory workstations, or bring-your-own-device programs may face elevated exposure. A successful exploit could allow local code execution with the privileges of the Chrome process, potentially leading to data theft, credential compromise, or lateral movement within corporate networks if Chrome is running in a high-trust context.

Affected systems

Google Chrome prior to version 149.0.7827.103 is directly affected. The vulnerability also impacts Chrome running on affected operating systems: Windows, macOS, and Linux systems that run vulnerable Chrome versions. Note that the underlying operating system (Windows, macOS, Linux kernel) is listed in the vulnerability record, but the bug itself resides in Chrome; updating Chrome resolves the issue regardless of OS version.

Exploitability

Real-world exploitability is constrained by the requirement for physical device access (CVSS vector AV:P). This is not a remote network vulnerability. An attacker must have hands-on access to unlock the device or exploit it during an unattended session. Public exploit code is not known to exist in active threat feeds, and the vulnerability is not yet listed in the CISA Known Exploited Vulnerabilities catalog. However, the lack of required privileges or user interaction means that once physical access is achieved, exploitation is straightforward.

Remediation

Update Google Chrome to version 149.0.7827.103 or later on all affected systems. Chrome's auto-update mechanism should deliver this patch automatically if enabled; administrators should verify deployment in environments where auto-update is disabled. No workarounds exist; patching is the only mitigation. Test patch deployment in non-production environments first to ensure compatibility with organizational workflow and any third-party extensions.

Patch guidance

Google has released version 149.0.7827.103 as the fixed version. Check your current Chrome version in Settings > About Chrome (Windows/Linux) or Chrome > About Google Chrome (macOS). The browser will offer an automatic update; restart Chrome to complete installation. Enterprise administrators using Chrome policies should verify that updates are not blocked by policy and that client machines have checked in within 24 hours. For managed deployments, consider using Chrome Enterprise for centralized version control and update scheduling to ensure timely patching across your fleet.

Detection guidance

Monitor for Chrome process crashes or abnormal termination on systems with physical access constraints (kiosks, shared workstations). Logs may show segmentation faults or heap corruption errors if the vulnerability is triggered. Endpoint Detection and Response (EDR) tools should flag unexpected child processes spawned by Chrome or unusual memory access patterns. Network monitoring alone will not detect this vulnerability since exploitation is local. Ensure Chrome is updated to the patched version and verify via software inventory or browser extension policies (e.g., via Chrome Enterprise or MDM solutions).

Why prioritize this

Despite Chromium's Critical severity designation, the CVSS 6.8 (MEDIUM) and physical access requirement justify medium priority for most remote-work-first organizations. Prioritize patching for high-risk local environments: shared devices, public kiosks, development machines, and lab workstations where physical security is harder to enforce. Organizations with strict physical access controls and primarily remote staff can defer patching to the next maintenance window but should not ignore it indefinitely.

Risk score, explained

The CVSS 3.1 score of 6.8 reflects the high impact (Confidentiality, Integrity, and Availability all marked High) but penalizes the attack vector (Physical, AV:P). The lack of privilege escalation requirement (PR:N) and user interaction (UI:N) indicates the flaw is trivial to trigger once physical access is obtained, but the Physical access vector prevents a higher score. This score appropriately conveys that the vulnerability is serious *for devices with inadequate physical security*, but poses minimal risk to locked or monitored machines.

Frequently asked questions