CVE-2026-11662: Chrome Type Confusion RCE in Bindings – CVSS 8.8

Technical summary

CVE-2026-11662 is a type confusion vulnerability (CWE-843) in Chrome's bindings implementation that permits remote code execution within the sandbox. The vulnerability exists in Chrome versions prior to 149.0.7827.103 and is triggered via a maliciously crafted HTML page. The type confusion allows an attacker to manipulate object types in memory, bypassing type safety checks and achieving arbitrary code execution. Although execution occurs within Chrome's sandbox environment, this significantly reduces but does not eliminate the attack impact. The vulnerability requires user interaction and network access but no authentication or special privileges.

Business impact

Organizations relying on Chrome for user browsing face immediate risk of data exfiltration and malware installation via drive-by attacks. Enterprises with strict sandboxing policies benefit from containment, but the vulnerability still enables theft of browsing history, cached credentials, and locally stored data. Supply-chain scenarios—such as compromised legitimate websites serving exploit payloads—create widespread exposure. The requirement for user interaction prevents worm-like propagation but does not eliminate the practical risk in environments where users visit diverse web content.

Affected systems

Google Chrome versions prior to 149.0.7827.103 are vulnerable across all supported operating systems, including Windows, macOS, and Linux. The vulnerability is platform-independent at the Chrome level; however, attack effectiveness and post-exploitation options may vary by OS. Organizations should treat all Chrome deployments below version 149.0.7827.103 as at-risk regardless of platform.

Exploitability

Exploitability is moderate-to-high. The attack vector is network-based (malicious HTML served over HTTP/HTTPS), and user interaction is required—the user must visit the attacker-controlled or compromised page and have Chrome process it. No special privileges or complex setup is required. The relative simplicity of triggering type confusion through HTML content and the high likelihood of users visiting untrusted sites in practice make this vulnerability practically exploitable. However, the attack is not wormable and requires victim engagement.

Remediation

Update Google Chrome to version 149.0.7827.103 or later immediately. Most organizations on auto-update channels will receive the patch automatically; verify deployment in centrally managed environments. For managed enterprise Chrome installations, confirm auto-update is enabled and monitor rollout completion. There is no known workaround that prevents the vulnerability; patching is the only remediation.

Patch guidance

Deploy Chrome version 149.0.7827.103 or later as priority. For enterprises: verify auto-update is enabled in Chrome policies, confirm rollout across all endpoints, and validate deployment through Chrome's built-in update status pages. For users: open Chrome > Help > About Google Chrome to trigger update check and automatic restart if required. Test patch deployment in non-production environments first if you maintain custom Chrome configurations or extensions, to ensure compatibility.

Detection guidance

Monitor for suspicious Chrome crashes or unexpected process terminations, which may indicate exploitation attempts. Log analysis should flag visits to known malicious domains serving exploit payloads. Endpoint detection and response (EDR) tools should alert on abnormal child processes spawned by Chrome or unusual Chrome process behavior. Browser telemetry (if enabled) may reveal exploitation attempts. Network IDS/IPS signatures targeting type confusion payloads in HTML may also be available from vendors; consult your security tool provider. Behavioral indicators include Chrome consuming unusual memory, generating unexpected network traffic, or accessing sensitive files after visiting untrusted sites.

Why prioritize this

This vulnerability warrants immediate patching due to the combination of high CVSS score (8.8), remote network attack vector, practical exploitability via malicious websites, and the absence of KEV/ransomware status (indicating limited real-world active exploitation at publication, but high inherent risk). Chrome's ubiquity and the ease of delivering malicious HTML make this a likely target for opportunistic attackers. Organizations should treat this as critical for user-facing deployments.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects the vulnerability's high impact—confidentiality, integrity, and availability are all compromised within the sandbox—combined with a low attack complexity and no required privileges. The user interaction requirement (UI:R) prevents a critical score but does not substantially reduce practical risk given the prevalence of web browsing. The sandbox constraint (S:U, scope unchanged) limits post-exploitation reach but does not prevent data exfiltration or local attacks.

Frequently asked questions