CVE-2026-11643: Google Chrome Use After Free Vulnerability

CVE-2026-11643 Overview

CVE-2026-11643 is a use-after-free vulnerability [CWE-416] in the Proxy component of Google Chrome prior to version 149.0.7827.103. A remote attacker can exploit this flaw by sending malicious network traffic to execute arbitrary code in the context of the browser process. Google's Chromium team rated the security severity as Critical, while the National Vulnerability Database (NVD) assigns it a HIGH severity rating. The flaw affects Chrome installations across Windows, macOS, and Linux platforms. Successful exploitation can lead to full compromise of the affected browser session and potentially the underlying host.

Critical Impact
Remote attackers can achieve arbitrary code execution via crafted network traffic targeting the Chrome Proxy component, with no user authentication required.

Affected Products

Google Chrome prior to 149.0.7827.103
Microsoft Windows installations running affected Chrome versions
Apple macOS and Linux installations running affected Chrome versions

Discovery Timeline

2026-06-09 - CVE-2026-11643 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-11643

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-416] within the Proxy component of Google Chrome. Use-after-free bugs occur when a program continues to reference memory after it has been freed, allowing attackers to manipulate the dangling pointer to redirect execution or corrupt program state. In this case, the freed object resides within the proxy handling subsystem, which processes network requests and responses. An attacker who controls or influences the network traffic reaching the browser can shape proxy-related object lifetimes to trigger the dangling reference.

Root Cause

The root cause is improper object lifetime management within Chrome's Proxy code paths. A reference to a proxy-related object persists after the underlying memory has been released, leaving a dangling pointer that subsequent operations dereference. Attackers can prime the heap to place attacker-controlled data at the freed location, enabling control over function pointers, virtual table entries, or other security-sensitive structures.

Attack Vector

Exploitation occurs over the network without authentication or user interaction. An attacker delivers malicious network traffic that causes Chrome to enter the vulnerable proxy code path. The attack complexity is rated High, indicating that successful exploitation depends on specific timing or heap state conditions. Once triggered, the use-after-free can be leveraged for arbitrary code execution within the renderer or browser process, depending on which Chrome process handles the affected proxy operation.

No public proof-of-concept code or exploit is currently available. Technical details are tracked in Chromium Issue #518006379.

Detection Methods for CVE-2026-11643

Indicators of Compromise

Chrome processes (chrome.exe, Google Chrome, chrome) crashing with access violations or segmentation faults referencing freed memory in proxy-related stack frames.
Unexpected child process creation from Chrome following network activity through proxy configurations.
Outbound connections from Chrome processes to unfamiliar hosts immediately after crash or restart events.

Detection Strategies

Inventory all endpoints running Chrome and flag installations below version 149.0.7827.103 for prioritized patching.
Monitor Chrome crash telemetry and Windows Error Reporting (WER) or crashpad artifacts for repeated faults in proxy handling code.
Correlate browser process anomalies with inbound network events that involve proxy auto-configuration (PAC) files or HTTP CONNECT traffic.

Monitoring Recommendations

Enable enterprise browser telemetry and forward Chrome version data and crash events to a central SIEM for version compliance and anomaly detection.
Alert on Chrome processes spawning shells, scripting hosts, or LOLBins such as powershell.exe, cmd.exe, or bash shortly after network activity.
Track DNS and HTTP requests originating from Chrome to newly registered or low-reputation domains that could deliver exploitation payloads.

How to Mitigate CVE-2026-11643

Immediate Actions Required

Update Google Chrome to version 149.0.7827.103 or later on all Windows, macOS, and Linux endpoints.
Verify automatic update mechanisms are enabled and functional across the enterprise fleet.
Restart Chrome on all endpoints after the update to ensure the patched binaries are loaded into memory.

Patch Information

Google released the fix in Chrome Stable channel version 149.0.7827.103. Refer to the Google Chrome Update Announcement for the official advisory and rollout details. Enterprises using managed Chrome deployments should push the update through Group Policy, Jamf, Intune, or equivalent management tooling.

Workarounds

Restrict outbound proxy configurations and disable PAC files from untrusted sources where business operations permit.
Apply network segmentation to limit browser exposure to untrusted networks until patching is complete.
Enforce site isolation and the Chrome enterprise policy SitePerProcess to reduce the impact of renderer-level compromise.

bash

# Verify installed Chrome version on Linux/macOS
google-chrome --version

# Windows: query installed Chrome version via registry
reg query "HKLM\Software\Google\Chrome\BLBeacon" /v version

# Force update via Chrome enterprise policy (Linux example)
/opt/google/chrome/chrome --check-for-update-interval=1