CVE-2026-11674: Critical Use-After-Free in Google Chrome Guest View (CVSS 8.8)

Technical summary

CVE-2026-11674 is a use-after-free vulnerability (CWE-416) in the Guest View component of Google Chrome prior to version 149.0.7827.103. The flaw stems from improper memory management that allows freed memory to be accessed after deallocation. An attacker can craft malicious HTML content that, when loaded in a Chrome browser, triggers the use-after-free condition and executes arbitrary code within the sandbox boundary. The Chromium security team has classified this as a High severity issue with a CVSS 3.1 score of 8.8, reflecting its network-accessible attack vector and high impact on confidentiality, integrity, and availability.

Business impact

Organizations relying on Chrome as their primary browser face elevated risk if users remain unpatched. While the sandbox containment reduces the likelihood of direct system compromise, memory corruption exploits can potentially escape sandbox restrictions under certain conditions. For enterprises managing information workers or using Chrome for sensitive tasks, unpatched instances create a window for data exfiltration or lateral movement facilitation. This is particularly concerning in environments where employees browse untrusted content or where threat actors can serve malicious ads or compromised web pages.

Affected systems

Google Chrome versions prior to 149.0.7827.103 are vulnerable on Windows, macOS, and Linux platforms. The vulnerability is not a Chrome-only issue; the underlying Guest View mechanism is part of the broader Chromium-based browser ecosystem. Organizations running Chrome on any of these operating systems should prioritize patching. While the source data lists macOS, Windows, and Linux as affected, the primary attack surface is the Chrome browser itself regardless of OS.

Exploitability

This vulnerability requires user interaction—specifically, a user must visit or be directed to a malicious webpage. This is not a zero-click or network-only attack. Exploitability is moderate to high in real-world scenarios because attackers can distribute crafted HTML through compromised websites, malvertising, phishing emails, or social engineering. The attack is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of the latest data, suggesting in-the-wild exploitation may still be emerging or limited. However, given the public disclosure and technical details, weaponization is likely only a matter of time.

Remediation

Immediately update Google Chrome to version 149.0.7827.103 or later. Chrome's auto-update mechanism typically deploys patches within days, but administrators should verify deployment across their environment. On Windows, enable Group Policy-driven updates if managing enterprise Chrome instances. On macOS and Linux, ensure auto-update is enabled or manually push the latest version. After patching, confirm that no instances of Chrome remain on vulnerable versions through your device management or endpoint detection systems.

Patch guidance

Navigate to Chrome menu > Help > About Google Chrome to trigger an immediate update check and download version 149.0.7827.103 or newer. For enterprise deployments: Windows administrators should reference Google's enterprise update documentation to push patches via Group Policy or mobile device management (MDM). macOS teams can use managed software distribution or verify updates through System Preferences. Linux administrators should update through their distribution package manager (apt, yum, etc.) or Docker image registry if using containerized Chrome. Verify the patch has been applied by checking chrome://version and confirming the version number matches or exceeds 149.0.7827.103.

Detection guidance

Monitor for unusual Guest View process spawning or abnormal memory access patterns in Chrome sandbox processes using EDR tools capable of tracking process memory operations. Look for correlated network traffic indicative of users visiting known malicious domains followed by child process spawning from the Chrome sandbox. Check browser extension logs and plugin activity for unexpected installations or suspicious behavior. In network-level detection, identify attempts to serve malformed HTML or JavaScript targeting Chrome Guest View features; DLP tools can flag exfiltration attempts from browser processes. Log-based detection should focus on Chrome crash reports or sandbox escape attempts reported in security event logs.

Why prioritize this

This vulnerability merits immediate patching priority due to its high CVSS score (8.8), low attack complexity, and the ubiquity of Chrome in enterprise and consumer environments. The memory corruption nature of use-after-free flaws creates a pathway to sandbox escape, which would elevate impact from contained to system-wide. Although user interaction is required and KEV listing is absent, the technical maturity of memory exploitation techniques means weaponized PoCs will emerge rapidly. Every day unpatched is a day the organization is exposed to a trivial-to-exploit, high-impact flaw.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects: Network-accessible attack vector (AV:N) allowing remote exploitation; low attack complexity (AC:L) requiring only a crafted HTML page; no special privileges needed (PR:N); user interaction required (UI:R) to visit a malicious page; and high impact on all three dimensions—confidentiality, integrity, and availability (C:H/I:H/A:H). The sandbox scope (S:U) means the impact is not limited to the security policy of the sandbox itself but extends to the broader system if the vulnerability is chained. The absence of KEV listing does not reduce the score, but it does suggest a potentially shorter exploitation window before active attacks materialize.

Frequently asked questions