CVE-2026-11628: Google Chrome Use After Free Vulnerability

CVE-2026-11628 Overview

CVE-2026-11628 is a use-after-free vulnerability [CWE-416] in the Ozone component of Google Chrome versions prior to 149.0.7827.103. Ozone is the abstraction layer Chromium uses for window system, display, and input handling across Linux, Windows, and macOS. An attacker with physical access to the device can trigger heap corruption by exploiting the dangling pointer condition. Google classifies the upstream Chromium severity as Critical, while the CVSS 3.1 base score is 6.8 due to the physical attack vector requirement. Successful exploitation can lead to memory corruption and, in chained scenarios, arbitrary code execution within the browser process.

Critical Impact
Local attackers with physical access can trigger heap corruption in the Ozone component, potentially leading to code execution and full compromise of the browser process.

Affected Products

Google Chrome versions prior to 149.0.7827.103
Chromium-based browsers on Microsoft Windows, Apple macOS, and Linux
Embedded Chromium runtimes that rely on the Ozone platform abstraction

Discovery Timeline

2026-06-09 - CVE-2026-11628 published to NVD
2026-06-09 - Last updated in NVD database
2026-06-09 - Google publishes Stable Channel update for Desktop addressing the issue

Technical Details for CVE-2026-11628

Vulnerability Analysis

The defect resides in Ozone, the platform abstraction layer that mediates between Chromium's UI stack and the underlying operating system's windowing, display, and input subsystems. A use-after-free condition occurs when Ozone code retains a pointer to a heap-allocated object after the object has been deallocated. Subsequent access through that dangling pointer corrupts the heap state.

The vulnerability requires physical access to the device, which constrains remote exploitation but matches threat models involving lost or stolen devices, kiosks, and shared workstations. An attacker who can interact with the local display, input devices, or removable media interfaces can drive the input or display state transitions needed to reach the vulnerable code path.

Chromium tracks the issue as Chromium bug 516501794. The current EPSS score of 0.016% reflects the limited remote attack surface, but local privilege boundaries inside the browser sandbox are still affected. The CWE-416 classification places this defect in the same family as many historically chained Chrome exploits used for sandbox escapes.

Root Cause

The root cause is improper object lifetime management within Ozone. A reference to a freed heap object is reused, allowing controlled data to occupy the previously valid allocation and influence subsequent control or data flow in the browser process.

Attack Vector

Exploitation requires physical proximity. An attacker with hands-on access to a device running a vulnerable Chrome build can manipulate Ozone state — for example, through display, input device, or window manager interactions — to free an object and then reach a code path that still dereferences it. The condition then becomes a heap corruption primitive suitable for further exploitation.

No verified public exploitation code is available. The vulnerability is described in prose based on Google's advisory and the linked Chromium issue. Refer to the Chromium Issue 516501794 and the Google Chrome Stable Update for technical context.

Detection Methods for CVE-2026-11628

Indicators of Compromise

Unexpected Chrome renderer or browser process crashes with heap corruption signatures in crash dumps referencing Ozone symbols
Chrome versions prior to 149.0.7827.103 reported by endpoint inventory on Windows, macOS, or Linux hosts
New or unfamiliar child processes spawned by chrome.exe or the Chrome helper processes following local user sessions on shared or kiosk devices

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 149.0.7827.103 as vulnerable
Hunt for repeated Chrome crash events correlated with physical session activity, console logins, or peripheral device changes
Monitor for post-crash process injection or unexpected persistence mechanisms originating from the Chrome process tree

Monitoring Recommendations

Forward Chrome crash reports and OS-level process termination events to a central analytics platform for correlation
Track physical session events such as console logon, USB device insertion, and display configuration changes on workstations running Chrome
Alert on Chrome browser process anomalies, including unexpected memory protection changes and unsigned module loads

How to Mitigate CVE-2026-11628

Immediate Actions Required

Update Google Chrome to version 149.0.7827.103 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after the update so the patched binary is loaded into memory
Audit shared, kiosk, and unattended devices first, since they carry the highest exposure to a physical attack vector
Apply equivalent updates for Chromium-based browsers and embedded runtimes that share the Ozone codebase

Patch Information

Google addressed the issue in the Stable Channel release announced in the Google Chrome Stable Update. The fix is included in Chrome 149.0.7827.103 for Desktop. Enterprises using managed Chrome deployments should push the update through their existing software distribution channels and verify the installed version on each host.

Workarounds

Enforce full-disk encryption and screen lock policies to reduce the value of physical access on lost or stolen devices
Restrict physical access to kiosks, conference room PCs, and shared workstations until patching completes
Disable or remove Chrome on devices that cannot be updated promptly and route users to a patched alternative

bash

# Verify the installed Chrome version on Linux
google-chrome --version

# Verify the installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify the installed Chrome version on Windows (PowerShell)
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion