CVE-2026-11630: Google Chrome Use-After-Free Vulnerability

CVE-2026-11630 Overview

CVE-2026-11630 is a use-after-free vulnerability [CWE-416] in the File Input component of Google Chrome prior to version 149.0.7827.103. A remote attacker can trigger heap corruption by serving a crafted HTML page to a target user. Successful exploitation can lead to arbitrary code execution within the renderer process, undermining browser sandbox assumptions and exposing sensitive data on the host. Chromium's internal security severity rating for this issue is Critical. The flaw affects Chrome on Windows, macOS, and Linux desktop builds.

Critical Impact
Remote attackers can corrupt heap memory through a crafted HTML page, enabling potential code execution in the renderer process across Windows, macOS, and Linux.

Affected Products

Google Chrome versions prior to 149.0.7827.103
Chrome desktop builds on Microsoft Windows, Apple macOS, and Linux
Chromium-based browsers consuming the affected File Input code path

Discovery Timeline

2026-06-09 - CVE-2026-11630 published to the National Vulnerability Database
2026-06-09 - Google publishes the Stable Channel update for Desktop
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-11630

Vulnerability Analysis

The vulnerability resides in Chrome's File Input handling, the subsystem responsible for processing <input type="file"> elements and associated file-selection events. A use-after-free condition occurs when the browser dereferences a heap object after it has already been released. An attacker who controls the timing of allocations and frees through scripted DOM manipulation can reclaim the freed memory with attacker-shaped data. The dangling pointer then operates on this controlled memory, producing heap corruption.

Exploitation requires user interaction — typically visiting a malicious or compromised web page. The attacker delivers JavaScript and HTML that drive File Input lifecycle transitions in a way that leaves a stale reference. Reliable exploitation chains commonly pair this primitive with a sandbox escape to achieve code execution outside the renderer.

Root Cause

The root cause is improper lifetime management of an object owned by the File Input implementation. Asynchronous callbacks or event handlers retain a raw pointer to an object that has been destroyed earlier in the call sequence. Subsequent access through the stale pointer leads to memory corruption.

Attack Vector

The attack vector is network-based and requires user interaction. A user visits an attacker-controlled page, an injected advertisement, or a compromised site delivering the exploit payload. No authentication or prior access to the target is required. See the Chromium Issue Tracker Entry and the Google Chrome Stable Update for vendor details.

No public proof-of-concept exploit is currently available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-11630

Indicators of Compromise

Chrome renderer process crashes with heap corruption signatures shortly after navigation to an external page
Outbound child processes spawned by chrome.exe or the Chrome Helper that do not match normal browser telemetry
Unexpected file writes or persistence artifacts following browsing sessions on untrusted domains

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 149.0.7827.103
Monitor browser telemetry for renderer crashes correlated with specific URLs or referrers
Correlate web proxy logs with endpoint process telemetry to identify suspicious post-navigation activity

Monitoring Recommendations

Centralize browser and endpoint logs in a SIEM to identify version drift and crash clusters
Alert on Chrome child processes launching scripting hosts, LOLBins, or shells
Track DNS and HTTP requests to newly registered or low-reputation domains hosting HTML payloads

How to Mitigate CVE-2026-11630

Immediate Actions Required

Update Google Chrome to version 149.0.7827.103 or later on all Windows, macOS, and Linux endpoints
Restart browsers after deployment so the patched binaries are loaded into memory
Verify enterprise update channels and Group Policy settings to confirm auto-update is functional

Patch Information

Google addressed CVE-2026-11630 in the Stable Channel update for Desktop, releasing Chrome 149.0.7827.103. Administrators should follow the Google Chrome Stable Update advisory and roll the patch through standard software distribution channels. Chromium-derived browsers should be updated once their vendors integrate the corresponding fix.

Workarounds

Restrict browsing to trusted sites through enterprise web filtering until patches are deployed
Enable Site Isolation and ensure the sandbox is not disabled by command-line flags or policy
Block or warn on file-upload interactions on untrusted domains using browser policies

bash

# Verify Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows registry check for installed Chrome version
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv