CVE-2026-11692: Chrome Read Anything Use-After-Free Sandbox Escape

Technical summary

CVE-2026-11692 is a use-after-free (CWE-416) vulnerability in the Read Anything component of Google Chrome. The flaw exists in how Chrome handles memory references after objects have been deallocated. An attacker with control of the renderer process can craft a malicious HTML document that triggers improper memory access, circumventing the sandbox boundary. The vulnerability requires user interaction (opening the page) but no additional privileges, and impacts Chrome versions before 149.0.7827.103 on multiple operating systems.

Business impact

If exploited, this vulnerability enables a two-stage attack: first gaining renderer process control through other means, then leveraging this flaw to escape the browser sandbox. Once outside the sandbox, an attacker can execute arbitrary system code with the privileges of the logged-in user, leading to potential theft of credentials, installation of persistent malware, lateral movement within the network, and data exfiltration. For organizations where Chrome is the primary browser or where users have elevated privileges, the blast radius is significant.

Affected systems

Google Chrome versions prior to 149.0.7827.103 on Windows, macOS, and Linux are vulnerable. All users of affected Chrome versions are at risk if they encounter a malicious webpage—either through direct navigation or drive-by download scenarios. Organizations running enterprise Chrome deployments with older versions face the highest immediate risk.

Exploitability

Exploitation requires a two-step process: an attacker must first compromise the Chrome renderer process (via another vulnerability, malicious extension, or social engineering), then deliver a crafted HTML page to trigger the use-after-free. The CVSS vector reflects high complexity due to this prerequisite and the need for user interaction, but once the renderer is compromised, weaponizing this flaw is relatively straightforward. No evidence of in-the-wild exploitation has been reported, and the vulnerability is not yet tracked on the CISA KEV catalog.

Remediation

Immediately update Google Chrome to version 149.0.7827.103 or later. Chrome's auto-update mechanism should deploy the patch automatically, but verify completion on critical systems. For managed environments, use Chrome enterprise policies to enforce the minimum version and disable downgrades. Additionally, implement application whitelisting and restrict execution of unsigned binaries to limit the impact of potential sandbox escapes.

Patch guidance

Update Chrome via Settings > About Google Chrome, which will trigger an automatic check and restart if a new version is available. For enterprise deployments, verify the rollout using your device management platform (MDM/EMM). Test the patched version in your environment before full deployment. Chrome's rapid release cycle means the patch is available immediately; delaying updates increases risk exposure. Consider accelerating patch deployment for high-risk user populations such as executives and researchers.

Detection guidance

Monitor for process crashes or unusual behavior in the Chrome renderer process, particularly if followed by suspicious child processes spawned from the Chrome executable. Track Chrome version inventory across your environment to identify machines still running versions prior to 149.0.7827.103. Review browser logs and security tool alerts for HTML pages that trigger renderer crashes or memory violations. Correlate unusual kernel-level activity with Chrome usage patterns. Given the sandbox-escape nature, focus on detecting privilege escalation attempts that originate from browser-spawned processes.

Why prioritize this

This vulnerability merits high priority due to its sandbox-escape capability and CVSS 8.3 severity score. While exploitation requires renderer compromise as a prerequisite, the chaining potential is significant in real-world attack scenarios where malicious extensions or other Chrome exploits are already present. The widespread use of Chrome and the impact of successful exploitation (full system compromise) justify rapid remediation. Organizations should treat this as critical for immediate patching, despite the lack of current KEV designation.

Risk score, explained

The CVSS 8.3 (HIGH) score reflects the combination of network-accessible attack vector, high impact across confidentiality, integrity, and availability, and the critical outcome of successful exploitation (sandbox escape). The high complexity rating acknowledges the prerequisite of renderer process compromise, lowering the score from critical; however, the scope change (breaking the browser sandbox) and full system impact elevate it significantly. The user interaction requirement further justifies the HIGH rather than CRITICAL designation, but the risk remains substantial in practice.

Frequently asked questions