CVE-2026-11650: Chrome V8 Use-After-Free Code Execution – Patch Guidance

Technical summary

CVE-2026-11650 is a use-after-free vulnerability (CWE-416) in the V8 JavaScript engine bundled with Google Chrome. Use-after-free flaws occur when code attempts to access memory that has already been freed, potentially allowing attackers to corrupt memory state and achieve arbitrary code execution. In this case, a crafted HTML page can trigger the flaw, leading to code execution within the Chrome sandbox context. The vulnerability is present in all Chrome versions prior to 149.0.7827.103. The attack vector is network-based with low attack complexity, requires user interaction, and does not require authentication or elevated privileges.

Business impact

This vulnerability poses a direct threat to enterprise users and consumers who browse the web using affected Chrome versions. Exploitation could lead to malware installation, credential theft, data exfiltration, or lateral movement into corporate networks if users access untrusted content. For organizations where Chrome is a primary browser or where users frequently visit third-party websites, this represents an elevated risk. The requirement for user interaction reduces the attack surface compared to wormable flaws, but targeted spear-phishing campaigns combining this vulnerability with social engineering could be highly effective.

Affected systems

Google Chrome versions prior to 149.0.7827.103 are directly affected. The vulnerability also affects the platforms on which Chrome runs: Apple macOS, Linux (including the Linux kernel used by Chromebook devices), and Microsoft Windows. Any system running a vulnerable Chrome version is at risk, regardless of the underlying operating system. Organizations should check their patch management and software inventory systems to identify all affected Chrome installations.

Exploitability

Exploitation requires a remote attacker to craft a malicious HTML page and trick a user into visiting it—either through a compromised website, a phishing email with a link, or drive-by download scenarios. The attack surface is moderate because it depends on user action; however, targeted campaigns against high-value targets or broad spray-and-pray attacks against popular websites could increase real-world exploitation likelihood. As of the source data timestamp, this vulnerability is not yet listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation in the wild has not been formally documented or disclosed, though this does not rule out private exploitation or proofs-of-concept among threat actors.

Remediation

Users and administrators must update Google Chrome to version 149.0.7827.103 or later. Chrome's auto-update mechanism should deploy the patch automatically on most systems, but verification is recommended, especially in managed environments. Users can manually check their Chrome version by navigating to chrome://settings/help, which will trigger an automatic update check and display the current version. For organizations managing Chrome deployments (via Active Directory, MDM, or similar tools), verify that the policy enforcement update is distributed and installed across all endpoints.

Patch guidance

Update Chrome to 149.0.7827.103 or later. Most users will receive this update automatically; however, systems that are offline or have auto-update disabled may require manual intervention. In enterprise environments, verify the patch deployment through your configuration management and endpoint monitoring tools. Test the patched version in a non-production environment if your organization has custom browser configurations or extensions that may be affected by the update. Consider communicating the security update to end-users to encourage prompt installation and to raise awareness of the risks of visiting untrusted websites.

Detection guidance

Monitor for Chrome version numbers lower than 149.0.7827.103 across your endpoint inventory. If available, use Mobile Device Management (MDM) or endpoint detection and response (EDR) solutions to query installed application versions. While this use-after-free vulnerability is difficult to detect in real time without behavioral analysis or advanced memory forensics, look for abnormal child process spawning from Chrome, unusual network connections initiated by the browser, or memory corruption patterns if your tools support those detections. Network-based detection is challenging since the attack occurs entirely within the browser, but intrusion detection systems tuned for drive-by download traffic may catch staging attacks.

Why prioritize this

Although not yet on the CISA KEV list, this vulnerability merits high priority due to its 8.8 CVSS score, low attack complexity, and the ubiquity of Chrome in consumer and enterprise environments. The combination of network-based attack vector, high impact (confidentiality, integrity, and availability), and user-interaction requirement places it above critical infrastructure threats but below zero-day worms in priority. Organizations should treat this as a must-patch item for all Chrome-using endpoints within 30 days, with critical user-facing systems prioritized within 7 days. Monitor for KEV list inclusion and adjust priority upward if active exploitation is confirmed.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects an attack vector that is network-accessible, requires minimal complexity, and results in complete compromise of confidentiality, integrity, and availability from the attacker's perspective (within the sandbox). The presence of user interaction (UI:R) prevents a perfect 9.8 score, but the low attack complexity and broad exploitability of JavaScript-based attacks keep the score elevated. The sandbox context does not reduce the CVSS score because Chrome's sandbox itself could be compromised as a stepping stone to further attacks.

Frequently asked questions