CVE-2026-11629 Overview
CVE-2026-11629 is a use-after-free vulnerability in the Ozone component of Google Chrome versions prior to 149.0.7827.103. Ozone is the abstraction layer Chrome uses to manage graphics and windowing across Linux, Windows, and macOS. A remote attacker can exploit the flaw by serving a crafted HTML page that triggers heap corruption in the browser process. Chromium classifies the underlying security severity as Critical, while the National Vulnerability Database assigns a HIGH rating. Successful exploitation requires user interaction such as visiting an attacker-controlled page. The flaw is tracked under [CWE-416] and affects Chrome on all major desktop operating systems.
Critical Impact
Remote attackers can trigger heap corruption through a malicious web page, potentially leading to arbitrary code execution within the Chrome renderer or browser process.
Affected Products
- Google Chrome prior to 149.0.7827.103
- Microsoft Windows (Chrome desktop)
- Apple macOS and Linux (Chrome desktop)
Discovery Timeline
- 2026-06-09 - CVE-2026-11629 published to NVD
- 2026-06-09 - Last updated in NVD database
- 2026-06 - Google releases fix in Chrome Stable channel update
Technical Details for CVE-2026-11629
Vulnerability Analysis
The vulnerability is a use-after-free condition in Chrome's Ozone subsystem. Ozone abstracts platform-specific windowing, input, and graphics buffer management for Chromium. Use-after-free flaws occur when memory is freed but a dangling pointer is later dereferenced. Attackers leverage this by reclaiming the freed allocation with attacker-controlled data, then forcing the dangling pointer to operate on that data.
In a browser context, this can lead to heap corruption that an attacker shapes to achieve control over execution flow. Chrome's Ozone code runs with significant privileges within the browser process, increasing the potential blast radius compared to sandboxed renderer-only flaws. Exploitation requires a victim to load a crafted HTML page, satisfying the user interaction requirement noted in the CVSS vector.
Root Cause
The root cause is improper lifetime management of an Ozone-owned object. Code paths release the object while another reference remains accessible, allowing later operations to dereference freed memory. The class of bug is tracked by [CWE-416] Use After Free.
Attack Vector
The attack vector is network-based. An attacker hosts a crafted HTML page or injects malicious content into an existing site, then lures the victim to load it. JavaScript and DOM manipulation primitives drive the allocation, free, and reuse sequence required to trigger the dangling reference. No authentication is required, and the attack succeeds with low complexity once the victim renders the page.
No public proof-of-concept or exploit code is currently available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. EPSS data places the probability of exploitation at 0.108%. Technical details remain restricted in Chromium Issue #516674532 per Google's standard disclosure policy.
Detection Methods for CVE-2026-11629
Indicators of Compromise
- Chrome browser processes crashing with heap corruption signatures, segmentation faults, or __chrome_crashpad_handler invocations following navigation events.
- Outbound network connections from chrome.exe to newly observed domains immediately preceding browser process anomalies.
- Unexpected child processes spawned by Chrome after rendering an external page.
Detection Strategies
- Inventory installed Chrome versions across the fleet and flag any host running a build earlier than 149.0.7827.103.
- Correlate browser crash telemetry with web proxy logs to identify the URL that triggered the fault.
- Monitor EDR telemetry for post-exploitation behaviors that follow browser compromise, including credential theft, token access, and lateral movement attempts.
Monitoring Recommendations
- Ingest Chrome crash reports and proxy logs into a central analytics platform to enable cross-source correlation.
- Track navigation to low-reputation domains paired with renderer or browser-process crashes within a short time window.
- Alert on Chrome processes performing unusual file writes, registry edits, or process injection consistent with sandbox escape behavior.
How to Mitigate CVE-2026-11629
Immediate Actions Required
- Update Google Chrome to version 149.0.7827.103 or later on Windows, macOS, and Linux endpoints.
- Force a browser restart after the update so the patched binary is loaded into memory.
- Validate deployment by querying installed versions across managed endpoints using your configuration management or EDR platform.
Patch Information
Google released the fix in the Chrome Stable channel as documented in the Google Chrome Stable Update. Enterprises managing Chrome via Google Admin Console, Microsoft Intune, or other MDM tooling should accelerate the rollout ring and confirm auto-update is enabled. Chromium-based browsers that consume the same upstream code should also be patched once their vendors ship corresponding builds.
Workarounds
- Restrict browsing to trusted domains using enterprise URL allowlists until patching is complete.
- Enable Chrome Site Isolation and ensure the renderer sandbox is not disabled by group policy.
- Deploy enterprise policies that block execution of Chrome versions below 149.0.7827.103 where supported.
# Verify the installed Chrome version on Linux
google-chrome --version
# Verify on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version
# Verify on Windows (PowerShell)
(Get-Item "$Env:ProgramFiles\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
