CVE-2026-11644: Critical Use-After-Free in Google Chrome Views on Linux

Technical summary

CVE-2026-11644 is a use-after-free memory corruption vulnerability (CWE-416) in Google Chrome's Views subsystem on Linux platforms. The vulnerability allows code execution when a crafted malicious extension is loaded into an affected Chrome instance. The attack requires convincing a user to install the extension, which serves as the initial infection vector. The Views component handles UI rendering and event processing in Chromium, making memory safety critical in this context. Use-after-free flaws in rendering engines can lead to complete system compromise when combined with modern exploitation techniques.

Business impact

Compromise of Chrome on Linux systems poses significant risk to organizations whose workforce relies on Chrome for web access or development work. An attacker leveraging this vulnerability could steal credentials, intercept sensitive communications, install persistent malware, or pivot laterally within corporate networks. Linux users—including developers, sysadmins, and DevOps professionals—are particularly valuable targets. The requirement for extension installation raises the bar for mass exploitation but remains feasible through social engineering, supply-chain compromise, or deceptive distribution methods. Organizations should prioritize patching in high-risk user segments.

Affected systems

Google Chrome versions prior to 149.0.7827.103 on Linux are affected. The vulnerability is specific to the Linux implementation of Chrome's Views component and does not affect Chrome on Windows or macOS (based on the CVE description scope). Any Chrome installation on Linux systems below the patched version remains vulnerable to users who install untrusted extensions.

Exploitability

While the CVSS vector indicates high impact (confidentiality, integrity, and availability all compromised), exploitation requires user interaction: the target must be convinced to install a malicious Chrome extension. This is not a network-only or client-side exploit that works without action. However, the bar for social engineering should not be underestimated; attackers regularly disguise malicious extensions as productivity tools, security utilities, or legitimate services. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting active in-the-wild exploitation has not yet been widely documented, but the critical Chromium severity rating indicates Google assessed it as dangerous.

Remediation

Update Google Chrome to version 149.0.7827.103 or later on all Linux systems. Organizations should enforce automatic Chrome updates where possible and audit installed extensions to identify and remove any suspicious or unnecessary ones. Implement Chrome policies to restrict extension installation to a curated allowlist of approved extensions, reducing the surface for social engineering attacks. Consider using Chrome Enterprise for centralized management and security policy enforcement.

Patch guidance

Deploy Chrome version 149.0.7827.103 or later across Linux systems. Most Chrome installations update automatically; verify completion by navigating to chrome://version and confirming the version number matches or exceeds the patched release. For enterprise environments, use Chrome Enterprise or administrator tools to manage rollout and monitor update compliance. Test patched versions in a non-production environment first to ensure compatibility with critical business extensions and workflows.

Detection guidance

Monitor Chrome extension installations via Chrome management policies or endpoint detection and response (EDR) tools. Look for suspicious extensions with unusual permissions (especially access to all sites, file system, or tabs). Inspect browser process memory dumps or crash logs for evidence of use-after-free exploitation (segmentation faults, heap corruption). On Linux, monitor /proc/[pid]/maps and memory access patterns for anomalous Views component behavior. Network-based detection is limited since the payload executes locally within Chrome; focus on post-exploitation artifacts such as lateral movement, credential access, or data exfiltration.

Why prioritize this

This vulnerability warrants immediate patching despite the CVSS score of 7.5 and lack of current KEV status. The reason: Chromium marked it Critical, it affects core rendering infrastructure, and it enables arbitrary code execution. The user-interaction requirement does not diminish urgency; extension-based attacks are proven, scalable, and regularly exploited in the wild. Linux users often include high-value targets (developers, system administrators, security researchers). Prioritize patching for staff with elevated access, sensitive roles, or high-risk browsing habits.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network vector with high complexity and required user interaction, balanced against high impact across confidentiality, integrity, and availability. The score may appear conservative relative to Chromium's Critical rating, which emphasizes the severity of the underlying flaw and the potential for weaponization. The discrepancy arises because CVSS penalizes user interaction, while Chromium's severity classifies the vulnerability itself. For prioritization purposes, align with Chromium's Critical assessment rather than relying solely on the CVSS number.

Frequently asked questions