CVE-2026-11694: Chrome ServiceWorker Use-After-Free Code Execution Vulnerability

Technical summary

CVE-2026-11694 is a use-after-free vulnerability (CWE-416) residing in Chrome's ServiceWorker subsystem. The defect allows a compromised renderer process to trigger memory access violations when ServiceWorker objects are improperly freed and subsequently referenced. An attacker must craft a malicious HTML page and convince a user to visit it; the renderer compromise is a prerequisite. Exploitation leads to arbitrary code execution within the sandbox boundary. Chrome versions prior to 149.0.7827.103 are affected.

Business impact

For organizations relying on Chrome as a primary browser or for web-based development workflows, this vulnerability creates a two-stage attack vector: initial renderer compromise followed by sandbox escape or privilege escalation. The requirement for user interaction (visiting a malicious page while the renderer is already compromised) limits broad exploitation, but targeted supply-chain or phishing campaigns could weaponize this effectively. Affected systems may face data exfiltration, malware installation, or lateral movement within corporate networks.

Affected systems

Google Chrome versions before 149.0.7827.103 on Windows, macOS, and Linux are vulnerable. The listing of the Linux kernel and host operating systems reflects the platform scope; however, the vulnerability itself resides in the Chrome browser. Verify your organization's Chrome deployment version against the patched release.

Exploitability

Exploitation requires two preconditions: (1) a compromised renderer process, and (2) user interaction to visit a crafted HTML page. The CVSS score of 7.5 (High) reflects the high impact (confidentiality, integrity, availability) but acknowledges the elevated attack complexity and user interaction requirement. This is not a zero-click or drive-by worm vector; it is most dangerous in targeted attacks where the renderer compromise is already established or in advanced persistent threat scenarios.

Remediation

Upgrade Google Chrome to version 149.0.7827.103 or later. Deploy updates across all managed endpoints using your organization's software deployment mechanisms. For environments where immediate patching is not feasible, consider disabling ServiceWorker functionality or restricting access to untrusted web content. Monitor renderer process integrity to detect potential compromise before exploitation of this flaw.

Patch guidance

Google Chrome updates are typically rolled out automatically; however, verify that affected systems have received the patch by checking Settings > About Chrome or querying the version programmatically. For managed deployments, use Chrome policy settings (e.g., update policies in Active Directory or Apple MDM) to enforce 149.0.7827.103 or later. Test patches in a controlled environment before enterprise-wide rollout. Verify against Google's official release notes to confirm the fix inclusion.

Detection guidance

Monitor for suspicious ServiceWorker registration patterns, unusual memory access errors in Chrome renderer processes, and crash dumps mentioning ServiceWorker. Collect browser security logs and sandbox violation alerts from endpoint detection and response (EDR) tools. Examine web access logs for visits to suspicious or newly registered domains that might host exploit pages. Cross-correlate renderer crashes with user activity timelines to identify potential attack windows.

Why prioritize this

Although this vulnerability requires renderer compromise as a prerequisite, it represents a critical escalation path once an attacker has a foothold. The High severity rating and sandbox-escape potential justify rapid prioritization in patching schedules. Organizations with high-value targets, development teams relying on Chrome extensions, or users frequently visiting untrusted sites should treat this as a priority. However, it is not as urgent as an unauthenticated remote code execution flaw.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects: (1) High impact across confidentiality, integrity, and availability; (2) network-based attack vector; (3) high attack complexity due to renderer compromise requirement; (4) requirement for user interaction; and (5) unchanged scope (sandbox isolation). The High severity category is appropriate for a code execution flaw, though the prerequisites prevent it from reaching Critical.

Frequently asked questions