CVE-2026-11646: Google Chrome Use-After-Free Vulnerability

CVE-2026-11646 Overview

CVE-2026-11646 is a use-after-free vulnerability [CWE-416] in the ViewTransitions component of Google Chrome. The flaw affects Chrome versions prior to 149.0.7827.103 on Windows, macOS, and Linux. A remote attacker can execute arbitrary code inside the Chrome sandbox by serving a crafted HTML page to a victim. Chromium engineers classified the issue as High severity. The bug requires user interaction, meaning a target must visit or be redirected to attacker-controlled content. Google has released a stable channel update that addresses the defect.

Critical Impact
Successful exploitation grants arbitrary code execution within the renderer sandbox, providing a foothold for further sandbox-escape chains and full browser compromise.

Affected Products

Google Chrome prior to 149.0.7827.103 on Microsoft Windows
Google Chrome prior to 149.0.7827.103 on Apple macOS
Google Chrome prior to 149.0.7827.103 on Linux

Discovery Timeline

2026-06-09 - CVE-2026-11646 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-11646

Vulnerability Analysis

The vulnerability resides in Chrome's ViewTransitions API, which orchestrates animated DOM state changes between page navigations. A use-after-free condition occurs when ViewTransitions code references a heap object after it has been released. An attacker who controls the lifecycle of the transition can trigger object destruction while a dangling pointer remains in use. When the freed memory is later reallocated with attacker-shaped data, the engine operates on attacker-controlled state.

Exploitation produces arbitrary code execution constrained by the renderer process sandbox. Sandbox-confined code execution is a common starting point for chained exploits that target sandbox-escape primitives in the broader Chromium stack. The bug class aligns with prior ViewTransitions and Blink lifecycle issues remediated through reference-count auditing and weak-pointer adoption.

Root Cause

The root cause is improper object lifetime management in the ViewTransitions implementation. The component retains a raw pointer or stale reference to a transition-related object across asynchronous tasks. When the underlying object is destroyed before the dependent operation completes, subsequent access dereferences freed memory. Use-after-free defects in Blink frequently trace back to renderer-side script callbacks that mutate the DOM during transition lifecycle events.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts a crafted HTML page that triggers the ViewTransitions code path with carefully timed DOM mutations or navigation events. The victim must load the page, typically through phishing, malvertising, or a compromised website. No authentication or prior access to the target system is required. Because the bug yields renderer-level execution, attackers commonly pair it with a separate sandbox escape to gain full code execution on the host.

A technical description of the defect, including reproducer details, is tracked in the Chromium Issue Tracker Entry.

Detection Methods for CVE-2026-11646

Indicators of Compromise

Chrome renderer crashes referencing ViewTransitions code paths or blink::ViewTransition in crash signatures
Outbound connections from chrome.exe child processes to uncategorized or newly registered domains following a page load
Unexpected child processes spawned by Chrome renderer processes shortly after navigation events

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 149.0.7827.103
Correlate browser crash telemetry with web proxy logs to identify users who loaded suspicious pages prior to renderer faults
Hunt for anomalous process trees where Chrome renderer processes spawn shells, scripting hosts, or LOLBins

Monitoring Recommendations

Forward Chrome crash dumps and chrome://crashes data to a central analysis pipeline for triage
Monitor EDR telemetry for memory-protection violations and exception events within Chrome renderer processes
Track DNS and HTTP telemetry for domains delivering HTML with heavy use of the ViewTransitions API outside of legitimate business traffic

How to Mitigate CVE-2026-11646

Immediate Actions Required

Update Google Chrome to version 149.0.7827.103 or later on Windows, macOS, and Linux endpoints
Restart Chrome after applying the update to ensure the patched binaries are loaded into memory
Verify enterprise auto-update policies are enabled and not blocked by group policy or network controls

Patch Information

Google published the fix in the stable channel update documented in the Google Chrome Release Update. Administrators should deploy Chrome 149.0.7827.103 or later through their standard software distribution channels. Chromium-based browsers that inherit Blink code, including Microsoft Edge and Brave, should be updated once their respective vendors publish corresponding releases.

Workarounds

Restrict browsing to trusted sites through web filtering until the patched version is deployed
Disable or block experimental ViewTransitions features through enterprise policy where supported
Enforce site isolation and the Chrome sandbox to limit the blast radius of a successful renderer compromise

bash

# Verify the installed Chrome version on Linux endpoints
google-chrome --version

# Windows: query the installed Chrome version via registry
reg query "HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Force update check on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --check-for-update-interval=1