CVE-2026-11643: Chrome Proxy Use-After-Free Code Execution Vulnerability

Technical summary

CVE-2026-11643 is a use-after-free memory safety vulnerability (CWE-416) residing in Chrome's Proxy subsystem. The defect allows a remote, unauthenticated attacker to corrupt memory state via malicious network traffic, potentially leading to code execution without user interaction or elevated privileges. The CVSS v3.1 score of 8.1 reflects the high impact (confidentiality, integrity, availability) and network-based attack vector, though the attack complexity is rated as high, indicating some constraint on practical exploitation.

Business impact

Successful exploitation could compromise user systems and data, enabling attackers to steal credentials, install malware, or pivot into corporate networks. For organizations relying on Chrome as a primary browser—especially in hybrid or remote work environments—this vulnerability poses a material risk to endpoint security posture. The lack of user interaction required for exploitation increases urgency relative to vulnerabilities requiring social engineering.

Affected systems

The vulnerability impacts Google Chrome installations on Windows, macOS, and Linux systems running versions before 149.0.7827.103. Because Chrome auto-updates by default on most platforms, exposure is typically time-limited; however, organizations with delayed or disabled auto-updates face extended risk windows. The vulnerability is specific to Chrome and does not directly affect the underlying operating systems themselves.

Exploitability

The attack requires network-level access to send malicious traffic to a Chrome instance, but does not require user interaction, authentication, or user clicks. Attack complexity is rated as high, suggesting successful exploitation depends on specific conditions such as precise memory state, Chrome version specifics, or network positioning. No public exploit code or proof-of-concept has been confirmed as of the publication and modification dates. The absence of a CISA KEV listing indicates no evidence of active, weaponized exploitation in the threat landscape at this time.

Remediation

Update Google Chrome to version 149.0.7827.103 or later on all affected systems. Chrome's built-in auto-update mechanism will deliver patches automatically on most configurations; verify completion by checking Settings > About Google Chrome. For managed environments, deploy updates via your browser management policy or endpoint management platform. Test patching in non-production environments first if your organization has custom extensions or enterprise configurations.

Patch guidance

Google Chrome patches are typically rolled out incrementally across the user base over several days. Administrators should verify update status by checking the browser version in chrome://settings/help or using your device management console. If auto-update is disabled, manually trigger updates or enable automatic updates in Chrome settings. For enterprise Chrome deployments, reference your organization's Chrome release schedule and ensure patch testing does not delay deployment beyond 30 days of the patch release. Validate that no critical extensions are broken by the update before full rollout.

Detection guidance

Monitor for Chrome instances running versions below 149.0.7827.103 using endpoint detection and response (EDR) tools, software inventory systems, or browser telemetry platforms. Network-level detection is challenging because exploitation traffic is encrypted (HTTPS) and difficult to distinguish from legitimate network activity without behavioral indicators. Focus detection efforts on post-exploitation artifacts: unexpected child processes spawned from chrome.exe, unusual network outbound connections from Chrome, or memory corruption crash logs. Consider collecting crash reports from Chrome installations to identify failed exploitation attempts.

Why prioritize this

Despite the absence of active exploitation (no KEV listing), the combination of Critical severity from Chromium, remote attack capability, lack of user interaction, and broad deployment of Chrome across enterprise endpoints warrants high prioritization. The vulnerability is in a core browser component (Proxy handling) that processes all HTTP/HTTPS traffic, maximizing exposure. Organizations should prioritize patching within 30 days and consider interim mitigations such as network segmentation or VPN enforcement if rapid patching is infeasible.

Risk score, explained

The CVSS v3.1 score of 8.1 (HIGH) reflects a severe but not critical baseline risk. The score is driven by remote network access, no privilege or user interaction required, and full compromise of confidentiality, integrity, and availability. The high attack complexity moderates the score from a critical rating, but this should not be misinterpreted as low exploitability in practice—it reflects that successful exploitation requires specific technical conditions rather than trivial attack steps. The absence of mitigation controls (no MFA bypass, no privilege escalation required) and broad target population elevates real-world risk relative to the numerical score.

Frequently asked questions