CVE-2026-11661: Chrome Use-After-Free Sandbox Escape on Windows

Technical summary

CVE-2026-11661 is a use-after-free vulnerability (CWE-416) in the Views subsystem of Google Chrome running on Windows. The flaw exists in versions prior to 149.0.7827.103. An attacker with control of the renderer process—a sandboxed component—can craft a specially formed HTML page that triggers memory access to a freed object, leading to arbitrary code execution outside the sandbox boundary. The vulnerability requires user interaction (viewing the page) but operates within an already-compromised rendering context, making it a powerful privilege escalation primitive.

Business impact

This vulnerability transforms a contained renderer-process compromise into a full system compromise. For organizations deploying Chrome, a two-stage attack—first compromising the renderer (via existing exploits or social engineering), then escaping the sandbox via this flaw—becomes practical. The impact includes potential credential theft, lateral movement to other systems, and persistence. Enterprises relying on Chrome's sandbox as a security boundary should prioritize remediation, particularly for users handling untrusted content or visiting adversary-controlled sites.

Affected systems

Google Chrome on Microsoft Windows prior to version 149.0.7827.103 is affected. This includes all supported Windows versions (7, 10, 11) on which Chrome 148 and earlier are deployed. Chrome on macOS, Linux, and Android are not mentioned in the CVE description and are presumed unaffected. The vulnerability requires the renderer process to already be compromised, so exposure is conditional on prior security incidents or malware presence.

Exploitability

Exploitability is moderately constrained but significant. An attacker must first compromise the Chrome renderer process—a non-trivial but achievable step given the prevalence of browser exploits. Once that foothold exists, the attacker can trigger this vulnerability by directing the victim to a crafted webpage, requiring only user interaction in the form of opening or viewing that page. No additional local privileges or authentication are needed post-compromise. The CVSS score of 8.3 reflects the confluence of network accessibility, high impact (code execution), and user interaction requirement.

Remediation

Update Google Chrome to version 149.0.7827.103 or later on all Windows systems. Chrome's auto-update mechanism typically handles this transparently, but administrators should verify deployment in controlled environments. For organizations managing Chrome via policy, deploy the patch through your MDM or group policy tools and confirm rollout before considering the vulnerability closed. Interim mitigation is difficult; sandboxed browsers or container-based browsing can reduce renderer compromise likelihood but do not address post-compromise escalation.

Patch guidance

Google Chrome delivers patches through its standard auto-update channel. Users should ensure Chrome is set to auto-update and allow any pending updates to install. To verify the installed version, navigate to Chrome Menu > Help > About Google Chrome—the browser will check for updates and display the current version. Organizations using Chrome Enterprise should deploy 149.0.7827.103 or later via their management console. Verify patch deployment by querying installed versions across your fleet or checking Chrome policy reports.

Detection guidance

Detection is challenging because the vulnerability requires pre-existing renderer compromise and crafted HTML interaction. At the network level, monitor for anomalous Chrome process behavior post-exploitation: unusual system calls, process elevation attempts, or unexpected spawning of child processes outside the sandbox. Endpoint detection and response (EDR) solutions should alert on Chrome escaping its sandbox boundaries, indicated by direct system calls or file access patterns inconsistent with normal operation. Log Chrome process execution, command-line arguments, and parent-child relationships. Correlate suspicious Chrome activity with prior suspicious web traffic or phishing indicators.

Why prioritize this

Despite the CVSS score of 8.3, this is a lower-priority patch in isolation because it requires prior renderer compromise. However, in threat environments where browser exploits and renderer flaws are common, or where targeted users face social engineering, this becomes critical as a chaining vector. Prioritize patching if you have evidence of renderer-targeting campaigns in your sector, or if you operate in high-threat industries. Standard enterprise patch cycles (within 30 days) are acceptable for organizations without elevated browser-exploit risk.

Risk score, explained

The CVSS 3.1 score of 8.3 (High severity) reflects high confidentiality, integrity, and availability impact (C:H, I:H, A:H) combined with network accessibility (AV:N) and user interaction (UI:R). The score is tempered by the high attack complexity (AC:H), which accounts for the requirement that the renderer must already be compromised—a non-trivial prerequisite. The scope change (S:C) indicates the vulnerability affects resources outside the vulnerable component. Overall, the score appropriately captures a serious post-compromise escalation that is not a primary infection vector but significantly amplifies the damage from renderer exploits.

Frequently asked questions