CVE-2026-11652: Chrome Use-After-Free Sandbox Escape Vulnerability (CVSS 8.3)

Technical summary

This use-after-free vulnerability (CWE-416) exists in Google Chrome's extension subsystem. The flaw allows an attacker controlling the renderer process to reference memory that has been freed, leading to potential code execution at a higher privilege level than the sandboxed renderer. The CVSS 3.1 score of 8.3 (HIGH) reflects the high confidentiality, integrity, and availability impact, though the attack complexity is high due to the prerequisite of renderer process compromise and required user interaction. The vulnerability affects Chrome on Windows, macOS, and Linux systems, as Chrome's rendering engine is consistent across these platforms.

Business impact

Successful exploitation could result in complete system compromise for Chrome users. An attacker who has already compromised a website or injection point could chain this sandbox escape to gain unrestricted access to the victim's machine, stealing sensitive data, installing malware, or using the system for further attacks. Organizations with strict browser security postures or those using Chrome in sensitive environments (developer workstations, high-value user systems) face elevated risk. The vulnerability is particularly concerning for users who frequently visit untrusted content or work with complex web applications.

Affected systems

Google Chrome on all major operating systems (Windows, macOS, Linux) running versions prior to 149.0.7827.103 are affected. The vulnerability is specific to Chrome's extension handling mechanism; users running Chrome without extensions or with only trusted, well-maintained extensions face reduced (but not eliminated) risk. Other Chromium-based browsers may also be affected depending on their base version and whether they have backported fixes.

Exploitability

Exploitation requires two preconditions: (1) the attacker must first compromise the renderer process, typically through a separate vulnerability or malicious website, and (2) the user must interact with the crafted HTML payload. While both conditions are non-trivial, the combination is realistic in scenarios where a user visits a compromised or malicious site. The high attack complexity rating reflects these requirements, but the ultimate impact—sandbox escape—is severe. This is not a one-click remote code execution vulnerability; it is a privilege escalation within an already-compromised browser context.

Remediation

Update Google Chrome to version 149.0.7827.103 or later immediately. Chrome's automatic update mechanism should handle this deployment, but users can manually verify their version in Chrome Settings > About Google Chrome. Verify the updated version before resuming normal browsing, especially if you frequently visit untrusted or third-party websites. Consider disabling or removing unnecessary extensions from your Chrome profile to reduce the attack surface, and review extension permissions regularly.

Patch guidance

Google Chrome version 149.0.7827.103 contains the fix for this vulnerability. Users on Windows, macOS, and Linux should receive automatic updates; however, some enterprise deployments may require manual update scheduling. Verify completion of the update by checking Chrome's version string in the About page. If you manage Chrome through group policy, mobile device management, or other enterprise tools, ensure your update channels are configured to push this version promptly. No configuration changes are required; patching is the sole remediation.

Detection guidance

Monitor for Chrome process crashes or unexpected terminations on user systems, which may indicate exploitation attempts. Examine browser history and network logs for visits to suspicious domains around the time of any system compromise. Security event logs should be reviewed for signs of privilege escalation or unexpected process execution at system level following a user's browsing session. Endpoint detection and response (EDR) tools configured to monitor process behavior can flag suspicious activity chains where a Chrome process spawns high-privilege system processes. However, detection is difficult if the sandbox escape is used solely for data exfiltration without launching additional processes.

Why prioritize this

While the vulnerability requires prior renderer compromise, the sandbox escape impact and the ubiquity of Chrome make this a high-priority patch. Users of Chrome in sensitive roles (developers, system administrators, researchers handling untrusted files) should patch immediately. Organizations should treat this as critical in their patch management workflows, particularly for devices that handle high-value or sensitive work. The lack of active exploitation in the wild (not on the KEV list) provides a brief window to patch before real-world attacks emerge.

Risk score, explained

The CVSS 3.1 score of 8.3 reflects HIGH severity due to the potential for complete system compromise (confidentiality, integrity, and availability all marked high impact). The score acknowledges attack complexity as high (requiring prior compromise and user interaction) and assumes network-based attack delivery. The resulting score positions this as a serious but not emergency-tier vulnerability—urgent patching is needed, but it is not in the critical category. The absence from the KEV catalog indicates no evidence of active, weaponized exploitation as of the latest update.

Frequently asked questions