CVE-2026-11646: Chrome Use-After-Free in ViewTransitions (Remote Code Execution)

Technical summary

CVE-2026-11646 is a use-after-free vulnerability (CWE-416) in the ViewTransitions implementation of Chromium. Use-after-free flaws occur when code attempts to access memory that has already been freed, potentially allowing attackers to manipulate that memory region and execute arbitrary instructions. In this case, the vulnerability is triggered via a maliciously crafted HTML page and results in code execution within the Chrome sandbox. The Chromium security team assigned this a High severity rating, reflecting both the nature of the defect and its exploitability.

Business impact

Successful exploitation could lead to compromise of user data processed within Chrome, including credentials, browsing history, cached website data, and files accessed through web applications. Because the attack requires a user to visit a malicious page, it fits a targeted phishing or watering-hole scenario. For organizations, the risk manifests primarily through end-user compromise rather than direct infrastructure attack—though attackers could use this as a foothold for lateral movement if the affected user has elevated privileges or access to sensitive internal systems.

Affected systems

Google Chrome prior to version 149.0.7827.103 is the primary affected component. The vulnerability also affects systems running this version of Chrome across multiple platforms: Windows, macOS, and Linux. Any user or device running an unpatched version of Chrome in the specified range is at risk. Browser extensions and web applications relying on ViewTransitions functionality are not independently vulnerable but are exposed to the flaw if running in an affected Chrome version.

Exploitability

The vulnerability is reachable and exploitable without special network positioning (network vector, low attack complexity) but does require user interaction—a user must open or interact with a crafted web page. This interaction barrier is moderate; it can be overcome through social engineering, phishing emails with malicious links, or compromised advertising networks. The CVSS score of 8.8 (High) reflects the ease of reaching the flaw and the severity of the impact, despite the user-interaction requirement. As of the data provided, this vulnerability is not yet listed in the CISA Known Exploited Vulnerabilities catalog, though this does not guarantee exploits do not exist in the wild.

Remediation

Update Google Chrome to version 149.0.7827.103 or later as soon as possible. Chrome typically auto-updates, but users should verify they are on the latest version by opening Chrome Settings > About Chrome, which will check for and install updates automatically. For organizations managing Chrome deployments, push the update through your standard patch management process and verify completion across all endpoints.

Patch guidance

Verify and deploy Chrome version 149.0.7827.103 or any subsequent release. Organizations using managed Chrome deployments (via Google Admin Console or third-party MDM solutions) should prioritize this update in their patching schedule. For users on auto-update, the patch should deploy automatically within days; manual check via Settings > About Chrome accelerates the process. No interim workarounds exist—patching is the only mitigation. Confirm patch application by checking Settings > About Chrome and confirming the version is 149.0.7827.103 or higher.

Detection guidance

Monitor for users visiting suspicious or unexpected websites, particularly if preceded by phishing emails or unusual external communication. Endpoint detection and response (EDR) tools may flag suspicious child processes spawned by Chrome or unusual memory access patterns within the browser process, though the sandboxed nature of the exploit may limit visibility. Web proxy and DNS logs can help identify traffic to known malicious domains. Within Chrome itself, users should remain vigilant for unusual browser behavior, unresponsive pages, or unexpected pop-ups. Security teams should track patch deployment metrics to ensure coverage across the user base.

Why prioritize this

This vulnerability warrants urgent patching due to the combination of high CVSS score (8.8), arbitrary code execution capability, and the reality that Chrome is ubiquitous in modern enterprises. User-interaction requirement does not substantially reduce urgency, given the prevalence of phishing and social engineering. The absence of a public exploit or KEV listing should not delay remediation—the vulnerability's technical characteristics make exploitation plausible. Organizations should treat this as a priority-one patch for all Chrome users.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects a High-severity vulnerability with network attack vector, low complexity, no privilege requirement, and user interaction needed. The impact is severe across confidentiality, integrity, and availability (all marked High). While the sandbox provides some containment, the ability to execute arbitrary code within the browser process and exfiltrate data stored there justifies the high score. The lack of KEV listing does not lower the intrinsic risk; it simply indicates CISA has not yet confirmed active exploitation, which is a confidence signal rather than a risk reduction.

Frequently asked questions