CVE-2026-11634: Google Chrome Use After Free Vulnerability

CVE-2026-11634 Overview

CVE-2026-11634 is a use-after-free vulnerability in the Gamepad component of Google Chrome on Windows. The flaw affects versions prior to 149.0.7827.103 and allows a remote attacker to perform a sandbox escape via a crafted HTML page. Chromium classifies the security severity as Critical. The weakness is tracked under CWE-416, Use After Free. Exploitation requires user interaction, such as visiting a malicious webpage, but no privileges or authentication are needed. A successful sandbox escape grants the attacker code execution outside Chrome's renderer sandbox, expanding the impact from the browser to the underlying Windows host.

Critical Impact
A remote attacker can escape the Chrome sandbox on Windows by luring a user to a crafted HTML page, enabling code execution beyond the browser process boundary.

Affected Products

Google Chrome on Windows prior to 149.0.7827.103
Microsoft Windows hosts running vulnerable Chrome builds
Chromium-based browsers sharing the affected Gamepad implementation

Discovery Timeline

2026-06-09 - CVE-2026-11634 published to the National Vulnerability Database
2026-06-09 - Last updated in the NVD database
2026-06-09 - Google publishes the Stable Channel Update for Desktop addressing the issue

Technical Details for CVE-2026-11634

Vulnerability Analysis

The vulnerability is a use-after-free condition in Chrome's Gamepad subsystem. The Gamepad API exposes connected game controllers to web content through the renderer process and supporting browser-side services. A flaw in object lifetime management permits code to dereference memory after the backing object has been released. An attacker who controls the freed allocation can corrupt program state and influence control flow.

Because the bug is reachable from web content and provides a sandbox escape path, it materially increases the consequence of a renderer compromise on Windows. The CVSS vector indicates network attack reachability with required user interaction and a scope change, consistent with the renderer-to-broker boundary crossing typical of sandbox escapes.

Root Cause

The defect stems from improper handling of object lifetime in the Gamepad component, classified as [CWE-416]. A reference or pointer to a Gamepad-related object is retained and later used after the object has been freed. The attacker triggers the condition through carefully timed JavaScript or DOM operations on a crafted HTML page. Additional technical details are tracked in the Chromium Issue Tracker #516975148.

Attack Vector

Exploitation requires a user to visit a malicious or compromised webpage. The page hosts JavaScript that interacts with the Gamepad API in a sequence that frees an object and then re-uses it. After corrupting memory in a privileged process boundary, the attacker leverages the primitive to escape the renderer sandbox and execute code in the broader Chrome process context on Windows.

No public proof-of-concept or in-the-wild exploitation is reported in the available data. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog. Refer to the Chromium Issue Tracker #516975148 for vendor-side technical references.

Detection Methods for CVE-2026-11634

Indicators of Compromise

Chrome on Windows reporting versions earlier than 149.0.7827.103 after the patch release window
Unexpected child processes spawned by chrome.exe outside normal renderer or utility patterns
Browser crash artifacts referencing Gamepad-related modules or renderer-to-broker IPC faults
Outbound connections from Chrome host processes to attacker-controlled infrastructure following navigation to untrusted sites

Detection Strategies

Inventory installed Chrome versions across Windows endpoints and flag any build below 149.0.7827.103
Monitor for anomalous process lineage where chrome.exe launches cmd.exe, powershell.exe, or other LOLBins
Hunt for crash telemetry tied to Gamepad device enumeration or navigator.getGamepads activity
Correlate browsing telemetry with endpoint process events to identify drive-by exploitation patterns

Monitoring Recommendations

Centralize browser version telemetry and patch posture into SIEM dashboards for continuous compliance review
Alert on Chrome renderer or broker process crashes occurring in clusters tied to specific URLs
Track DNS and proxy logs for traffic to newly registered domains accessed via Chrome immediately before suspicious child process creation

How to Mitigate CVE-2026-11634

Immediate Actions Required

Update Google Chrome on Windows to version 149.0.7827.103 or later on all managed endpoints
Force-restart Chrome after deployment to ensure the patched binary is loaded into memory
Audit Chromium-based browsers and embedded WebView components for equivalent updates from their vendors
Restrict access to untrusted web content for users who cannot be patched immediately

Patch Information

Google addressed CVE-2026-11634 in the Chrome Stable channel update referenced in the Stable Channel Update for Desktop. The fixed version on Windows is 149.0.7827.103. Enterprise administrators should deploy the update through Google Update, Microsoft Intune, Configuration Manager, or other managed software distribution tooling.

Workarounds

Enforce automatic Chrome updates through enterprise policy to minimize patch latency
Apply web filtering and DNS controls to block known malicious or untrusted domains
Use site isolation and disable unneeded experimental browser features where operationally feasible
Educate users to avoid clicking links from unverified sources until patching is complete

bash

# Verify Chrome version on a Windows endpoint via PowerShell
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Force Chrome update check via Google Update administrative template
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f