CVE-2026-11644: Google Chrome Use After Free Vulnerability

CVE-2026-11644 Overview

CVE-2026-11644 is a use-after-free vulnerability [CWE-416] in the Views component of Google Chrome on Linux. The flaw affects Chrome versions prior to 149.0.7827.103. An attacker who convinces a user to install a malicious Chrome extension can exploit the dangling pointer condition to execute arbitrary code in the browser process. Google's Chromium team rated the underlying security severity as Critical, while NVD assigned a CVSS 3.1 base score of 7.5 (HIGH). Exploitation requires user interaction in the form of installing a crafted extension, which raises attack complexity but does not eliminate risk in enterprise environments where extension governance is weak.

Critical Impact
Successful exploitation grants arbitrary code execution within the Chrome process on Linux endpoints, enabling sandbox-adjacent attacks, credential theft, and persistent extension-based footholds.

Affected Products

Google Chrome on Linux prior to 149.0.7827.103
Linux distributions running vulnerable Chrome builds
Enterprise deployments permitting third-party Chrome extension installation

Discovery Timeline

2026-06-09 - CVE-2026-11644 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-11644

Vulnerability Analysis

The vulnerability resides in Chrome's Views component, the cross-platform UI framework that renders browser windows, menus, and dialogs on Linux. A use-after-free condition occurs when code retains a pointer to a Views object after that object has been deallocated. An attacker controlling a malicious extension can trigger the lifecycle race that frees the underlying object while a stale reference is still in use. Subsequent operations on the freed memory allow controlled writes or function pointer hijacking, leading to arbitrary code execution inside the Chrome process.

Because extensions execute with elevated privileges relative to web content, the attacker gains a reliable trigger surface without requiring a separate sandbox escape primitive. The Chromium Issue Tracker entry 518043597 and the Google Chrome Update Announcement document the affected build.

Root Cause

The root cause is improper object lifetime management in Views. A reference to a UI object outlives the object's destruction, leaving a dangling pointer. When the freed slab is reallocated with attacker-controlled data, dereferencing the stale pointer transfers control to attacker-supplied state. This pattern is classified under CWE-416: Use After Free.

Attack Vector

Exploitation begins with social engineering. The attacker convinces a user to install a crafted Chrome extension from outside trusted channels or through a compromised developer account. Once installed, the extension issues API calls that drive the Views component into the vulnerable state. The attacker then reclaims the freed memory and pivots to arbitrary code execution on the Linux host running Chrome.

Detection Methods for CVE-2026-11644

Indicators of Compromise

Chrome extensions installed from non-Web Store sources or with unusual permission requests for tabs, webRequest, or nativeMessaging
Chrome process crashes referencing Views or UI thread stack frames on Linux
Outbound connections from Chrome child processes to unexpected hosts shortly after extension installation
Unexpected child processes spawned by chrome on Linux endpoints

Detection Strategies

Inventory installed Chrome extensions across the fleet and compare against an allowlist of approved IDs
Monitor Chrome version telemetry to identify hosts running builds older than 149.0.7827.103
Hunt for process trees where chrome spawns shell interpreters such as bash, sh, or python on Linux
Correlate extension installation events with crash dump generation in ~/.config/google-chrome/Crashpad

Monitoring Recommendations

Forward Chrome policy and extension telemetry to a centralized SIEM for longitudinal analysis
Track Chromium stable channel releases and alert when endpoints lag patch availability by more than 72 hours
Enable enterprise reporting via Chrome Browser Cloud Management to capture extension install events
Audit Linux endpoints for unauthorized writes to Chrome preference files and extension directories

How to Mitigate CVE-2026-11644

Immediate Actions Required

Update Google Chrome on all Linux endpoints to version 149.0.7827.103 or later
Restrict extension installation to an enterprise allowlist using the ExtensionInstallAllowlist policy
Remove any unsanctioned or recently installed extensions pending review
Communicate guidance to users to reject extension installation prompts from untrusted sources

Patch Information

Google released the fix in Chrome stable channel build 149.0.7827.103 for Linux. Refer to the Google Chrome Update Announcement for distribution details. Package maintainers for major Linux distributions ship the fix through their standard Chrome repositories.

Workarounds

Enforce ExtensionInstallBlocklist set to * and explicitly allowlist required extension IDs until patching completes
Disable developer mode for extensions via the DeveloperToolsAvailability policy
Apply application control to prevent execution of unsigned Chrome extension packages

bash

# Example Chrome enterprise policy on Linux: /etc/opt/chrome/policies/managed/extensions.json
{
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": [
    "approved_extension_id_1",
    "approved_extension_id_2"
  ],
  "DeveloperToolsAvailability": 2
}