CVE-2026-11664: Critical Use-After-Free in Chrome Payments—Patch Now

Technical summary

CVE-2026-11664 is a use-after-free vulnerability (CWE-416) in the Payments subsystem of Chromium-based browsers. Use-after-free flaws occur when software attempts to access memory that has already been freed, potentially allowing an attacker to read, write, or execute code at that memory location. In this case, a specially crafted HTML page can trigger the vulnerability, leading to heap corruption. The attack requires user interaction—specifically, visiting the malicious page—and does not require authentication or special privileges on the target system.

Business impact

Organizations relying on Chrome as a standard browser face potential compromise of user sessions, data theft, and malware infection. A successful exploit could give attackers access to sensitive information handled within the browser, including credentials, payment data, and browsing history. Teams should expect increased support requests as users encounter unstable browser behavior or encounter exploit attempts. For organizations managing Chrome at scale, this represents a mandatory patching priority to prevent targeted attacks against high-value users.

Affected systems

Google Chrome versions prior to 149.0.7827.103 are affected. Because Chromium is the basis for multiple browsers and operating systems, the vulnerability's impact extends across Windows, macOS, and Linux environments where Chrome is deployed. Users of Chromium-based browsers and embedded Chromium components should verify their specific product versions against vendor advisories.

Exploitability

The vulnerability is readily exploitable in real-world scenarios. It requires only a network vector (AV:N) with low attack complexity (AC:L), meaning no special network conditions or exploitation techniques are needed. Critically, no authentication or elevated privileges are required (PR:N), and the attack succeeds with standard user interaction (UI:R)—simply visiting a malicious webpage. The attack does not require tricking the user into unusual actions beyond normal browsing. Given these factors, exploitation is practical and likely to be attempted by threat actors.

Remediation

Update Google Chrome to version 149.0.7827.103 or later immediately. Users should enable automatic updates if not already configured, as Chrome typically applies security patches automatically. Organizations managing Chrome deployments should verify update completion across their user base and consider temporary browser restrictions on high-risk users until patching is confirmed. For users unable to patch immediately, minimize exposure by avoiding untrusted websites and disabling JavaScript in high-risk contexts if operationally feasible.

Patch guidance

Google has released Chrome 149.0.7827.103 as the fix version. Verify this version number in your environment by checking About Chrome, which will display the current version and automatically check for updates. For enterprise deployments, use your mobile device management (MDM) or group policy tools to enforce the patched version. Monitor Chrome's release notes and security bulletins for any subsequent patch versions addressing related issues. Test the update in a limited environment before broad deployment to ensure compatibility with critical web-based applications.

Detection guidance

Monitor Chrome crash reports and browser stability logs for patterns of use-after-free crashes, which often appear as memory protection violations or heap corruption errors. Network detection is challenging for this vulnerability since it requires a user to visit a malicious page; focus instead on behavioral signals such as unexpected JavaScript execution, abnormal memory usage spikes in the browser process, or visits to known malicious domains. Endpoint detection and response (EDR) tools should flag suspicious memory access patterns within browser processes. User reports of browser crashes after visiting certain websites should be treated as potential exploitation attempts.

Why prioritize this

This vulnerability merits immediate attention due to its high CVSS score (8.8), low attack complexity, lack of authentication requirements, and high impact across confidentiality, integrity, and availability. The Payments component's sensitivity—often handling financial and personal information—amplifies the risk. Wide deployment of Chrome across enterprises and the practical exploitability make this a high-priority patch. The absence of KEV listing does not diminish urgency; organizations should not wait for widespread public exploitation before patching.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects the vulnerability's critical characteristics: network-based attack vector with low complexity, no authentication barrier, user interaction requirement only for initial compromise, and high impact on confidentiality (data disclosure), integrity (code execution), and availability (denial of service through crashes). The use-after-free nature enables memory corruption that can lead to arbitrary code execution, the most severe outcome. The scope is unchanged, meaning impact is limited to the vulnerable component, but the combination of factors—particularly the practical exploitability and sensitive Payments context—justifies the high severity rating.

Frequently asked questions