CVE-2026-11679: Chrome Sandbox Escape via Codec Use-After-Free on Windows

Technical summary

CVE-2026-11679 is a use-after-free (CWE-416) vulnerability in Codecs within Google Chrome on Windows versions prior to 149.0.7827.103. The flaw allows an attacker with an already-compromised renderer process to craft HTML that triggers unsafe memory access in codec operations. By exploiting this use-after-free condition, the attacker can escape Chrome's sandbox isolation and achieve arbitrary code execution with OS-level privileges. The vulnerability requires user interaction (page visit) and a pre-existing renderer compromise, but carries high impact across confidentiality, integrity, and availability.

Business impact

Successful exploitation enables complete system compromise following renderer process breach. For enterprises, this means an attacker pivoting from a compromised renderer (via phishing, malicious ads, or another browser exploit) could gain administrative access without additional user action. This threatens data exfiltration, lateral movement, malware installation, and persistent access. Organizations relying on Chrome's sandbox as a security boundary should treat renderer-to-OS escape chains as critical business risk.

Affected systems

Google Chrome on Windows prior to version 149.0.7827.103 is affected. The vulnerability is specific to Windows platforms and codec-related processing. Any user running an unpatched version of Chrome on Windows remains at risk, particularly in environments where users may encounter untrusted web content or where attackers can inject malicious pages into otherwise legitimate browsing sessions.

Exploitability

Exploitation requires two preconditions: (1) the attacker must first compromise the Chrome renderer process (via a separate vulnerability, malicious page, or supply-chain attack), and (2) the victim must then visit a page containing the malicious HTML payload. While the CVSS score of 8.3 reflects high severity, the practical exploitation bar is elevated by the need for prior renderer compromise. However, chaining this with known renderer vulnerabilities or zero-days creates a viable attack path, particularly in targeted campaigns.

Remediation

Update Google Chrome to version 149.0.7827.103 or later on all Windows systems. Organizations should enforce automatic Chrome updates or deploy group policy controls to mandate patching. Since this is a sandbox escape vulnerability, remediation priority should be high to prevent privilege escalation from renderer compromises. Verify patch deployment across workstations and servers running Chrome.

Patch guidance

Apply Google Chrome version 149.0.7827.103 or later. Users can manually verify their version by navigating to Chrome Menu > Help > About Google Chrome; the browser will automatically download and install the patch, requiring a restart. Enterprise administrators should use Chrome Management Console or equivalent endpoint management to push updates and confirm deployment. Consider testing in a pilot environment before full rollout to ensure compatibility with internal web applications.

Detection guidance

Monitor for abnormal process behavior following Chrome renderer crashes or renderer process spawning suspicious child processes with elevated privileges. Examine Windows Event Logs for sandbox escape indicators: unusual system calls from Chrome processes, unexpected SYSTEM-level process creation from Chrome binaries, or repeated codec-related errors preceding suspicious activity. Memory sanitizer logs and Chrome crash reports may contain use-after-free signatures. Behavioral analytics tools should flag attempts to escape sandbox boundaries or access protected memory regions from browser processes.

Why prioritize this

Although the vulnerability requires prior renderer compromise, sandbox escape vulnerabilities warrant urgent patching because they enable attackers to amplify the impact of other browser compromises into OS-level control. The CVSS 8.3 HIGH severity and full system impact (C:H, I:H, A:H) justify rapid deployment. Organizations should treat this as part of a defense-in-depth assessment: even if renderer attacks are unlikely in their environment, the post-compromise risk is severe.

Risk score, explained

The CVSS 3.1 score of 8.3 (HIGH) reflects high impact across confidentiality, integrity, and availability, plus the broad attack vector (network). The score is tempered by the requirement for high attack complexity (prior renderer compromise) and user interaction (visiting a malicious page). The cross-site impact indicator (S:C) acknowledges that OS-level access affects not just Chrome but the entire system. This score appropriately represents a severe post-compromise escalation risk rather than a standalone initial-access vulnerability.

Frequently asked questions