CVE-2026-11680: Chrome Media Use-After-Free RCE Vulnerability (Windows)

Technical summary

CVE-2026-11680 is a use-after-free vulnerability (CWE-416) in Google Chrome's Media processing engine on Windows. The flaw occurs when Chrome improperly manages memory for Media objects, allowing freed memory to be accessed and manipulated after it has been deallocated. An attacker can exploit this by hosting a malicious HTML page that triggers the vulnerable code path. Successfully exploiting the vulnerability leads to arbitrary code execution within the Chrome sandbox context. The vulnerability was assigned a CVSS v3.1 score of 8.8 (High severity) with a network attack vector, low attack complexity, and no privilege requirements—only user interaction is needed.

Business impact

Exploitation of this vulnerability could enable attackers to compromise user endpoints and extract sensitive information such as login credentials, authentication tokens, or confidential business data accessible through the browser. The sandboxed execution environment provides some mitigation, but a motivated attacker could potentially chain this flaw with other exploits to break out of the sandbox entirely. Organizations with users on Windows systems running vulnerable Chrome versions face elevated risk of data theft, credential compromise, and downstream lateral movement within corporate networks.

Affected systems

Google Chrome on Windows prior to version 149.0.7827.103 is affected. Organizations should inventory Chrome installations on Windows systems and cross-reference against the patched version threshold. The vulnerability does not affect Chrome on macOS, Linux, or other platforms, nor does it affect other Chromium-based browsers unless they also contain the same vulnerable code path. Microsoft Windows is listed as an affected vendor component, though the core vulnerability resides in Chrome's Media engine.

Exploitability

The vulnerability has a low attack complexity and requires only user interaction—specifically, a user must visit or be redirected to a malicious HTML page. No special network conditions, authentication, or privileged access is necessary. The attack can be delivered via phishing links, malvertising, or compromised websites. As of the vulnerability's publication, it is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation in the wild has not yet been widely documented; however, organizations should not rely on this status as a signal of low urgency.

Remediation

Apply the security update to Google Chrome version 149.0.7827.103 or later on all Windows systems. Chrome's automatic update mechanism should deploy patches if enabled. Organizations should verify that auto-updates are configured correctly and that no deployment policies are preventing timely patching. For enterprise environments, administrators should test the patched version in a staging environment before broad rollout, and coordinate patching to minimize disruption.

Patch guidance

Google has released Chrome version 149.0.7827.103 containing the fix for this vulnerability. Users and administrators should initiate Chrome updates immediately. In Windows environments, Chrome typically auto-updates in the background; verify the installed version by navigating to Chrome Menu > Help > About Google Chrome, which will display the current version and trigger any pending updates. Enterprise customers using Chrome OS or managed Chrome deployments should consult Google's official security advisory and the Chrome release notes for detailed patch deployment guidance and any associated configuration changes.

Detection guidance

Monitor for signs of exploitation by reviewing Chrome crash logs and sandbox violation attempts on Windows systems, particularly if processes spawned from Chrome show unexpected behavior or suspicious file access patterns. Endpoint Detection and Response (EDR) tools should flag unusual child processes launched from Chrome or abnormal memory access patterns. Additionally, monitor network traffic from Chrome processes for suspicious outbound connections that might indicate data exfiltration post-exploitation. Web traffic logs may reveal access to known malicious HTML pages designed to trigger this flaw, though custom payloads may evade signature-based detection.

Why prioritize this

This vulnerability merits urgent prioritization due to its high CVSS score (8.8), low attack complexity, and minimal user interaction requirements. Although sandboxing provides containment, the severity of potential impact—arbitrary code execution—combined with the ease of exploitation makes this a significant risk. The absence of a KEV entry does not diminish urgency; organizations should assume that capable threat actors are already investigating or exploiting this flaw. Patching should proceed on an accelerated timeline, particularly for externally-facing roles or systems where users frequently visit untrusted websites.

Risk score, explained

The CVSS v3.1 score of 8.8 reflects a High-severity vulnerability with network-based attack feasibility, low complexity, and no privilege or authentication requirements. The primary driver of the high score is the integrity and confidentiality impact (both rated High), combined with potential availability impact and the requirement only for user interaction. The sandbox context provides some mitigation against the worst-case scenarios (complete system compromise), but does not eliminate the risk of data theft or further attack chain development.

Frequently asked questions