CVE-2026-11637: Google Chrome Use-After-Free Vulnerability

CVE-2026-11637 Overview

CVE-2026-11637 is a use-after-free vulnerability in the Views component of Google Chrome on macOS. The flaw affects Chrome versions prior to 149.0.7827.103 and allows a remote attacker to execute arbitrary code by serving a crafted HTML page. Google rated the underlying Chromium issue as Critical security severity. The weakness maps to CWE-416: Use After Free. Successful exploitation requires user interaction, specifically loading the malicious page in the browser. The vulnerability impacts confidentiality, integrity, and availability of the affected host.

Critical Impact
A remote attacker can execute arbitrary code in the context of the Chrome renderer on macOS by enticing a user to visit a crafted HTML page.

Affected Products

Google Chrome on macOS versions prior to 149.0.7827.103
Apple macOS (host platform for affected Chrome builds)
Chromium-based applications embedding the vulnerable Views component

Discovery Timeline

2026-06-09 - CVE-2026-11637 published to the National Vulnerability Database
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-11637

Vulnerability Analysis

The vulnerability resides in the Views subsystem of Chrome on macOS. Views is the cross-platform UI framework Chromium uses to render browser windows, dialogs, and controls. A use-after-free condition occurs when code retains a pointer to an object after that object has been freed. Subsequent access to the dangling pointer enables memory corruption.

In this case, a crafted HTML page can trigger the lifecycle conditions that lead to the freed object being referenced. An attacker who controls the freed memory region can shape it to redirect execution. The result is arbitrary code execution within the Chrome process boundary on macOS.

Exploitation requires the victim to load the attacker-controlled page. No authentication or prior access is needed. The Chromium project tracks the underlying defect in the Chromium Issue Tracker Entry.

Root Cause

The root cause is improper object lifetime management within Views on the macOS platform. A code path frees a UI-related object while another reference remains live. Operations performed through the stale reference dereference freed memory, which an attacker can groom to control program flow.

Attack Vector

The attack vector is network-based and requires user interaction. The attacker hosts a malicious HTML page or compromises a site the victim visits. Once the page loads, scripted DOM and UI interactions drive the Views component into the vulnerable state. No verified public exploit code is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified public proof-of-concept is available. The vulnerability mechanism is described in the Chromium Issue Tracker Entry and the Google Chrome Stable Update.

Detection Methods for CVE-2026-11637

Indicators of Compromise

Chrome processes on macOS crashing with signals consistent with memory corruption (SIGSEGV, SIGBUS) shortly after navigation events.
Unexpected child processes spawned by Google Chrome.app or its Helper processes following a browsing session.
Outbound connections from Chrome Helper processes to untrusted domains hosting heavily obfuscated HTML or JavaScript.

Detection Strategies

Inventory Chrome versions across macOS endpoints and flag any build below 149.0.7827.103.
Hunt for Google Chrome Helper (Renderer) crashes in ~/Library/Logs/DiagnosticReports/ correlated with recent web navigation.
Monitor for anomalous process creation chains where Chrome Helper processes spawn shell utilities such as bash, osascript, or curl.

Monitoring Recommendations

Ingest macOS Endpoint Security Framework telemetry to track Chrome process behavior and child process creation.
Alert on browser-initiated writes to LaunchAgents, LaunchDaemons, or login items, which often follow renderer compromise.
Correlate web proxy logs with endpoint crash telemetry to identify URLs that consistently precede Chrome instability.

How to Mitigate CVE-2026-11637

Immediate Actions Required

Update Google Chrome on all macOS systems to version 149.0.7827.103 or later.
Restart Chrome after the update so the new binary is loaded on every endpoint.
Verify managed deployments through MDM and enforce automatic updates for the Chrome channel in use.

Patch Information

Google addressed CVE-2026-11637 in the Chrome Stable channel release documented in the Google Chrome Stable Update. Administrators should deploy Chrome 149.0.7827.103 or later on macOS. Chromium-based browsers and embedded WebViews should pull the corresponding upstream fix referenced in the Chromium Issue Tracker Entry.

Workarounds

Restrict browsing to trusted sites until patching is complete, using web filtering or DNS controls.
Use enterprise policy to disable or restrict features that increase renderer attack surface where operationally feasible.
Apply application allowlisting on macOS so that processes spawned by Chrome Helper outside an approved set are blocked.

bash

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Force update check via the Google Software Update agent
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode oneshot -userInitiated YES