CVE-2026-11652: Google Chrome Use-After-Free Vulnerability

CVE-2026-11652 Overview

CVE-2026-11652 is a use-after-free vulnerability [CWE-416] in the Extensions component of Google Chrome prior to version 149.0.7827.103. A remote attacker who has already compromised the renderer process can exploit this flaw via a crafted HTML page to potentially perform a sandbox escape. The Chromium project assigned this issue a security severity rating of High.

Google addressed the issue in the Stable channel update for desktop and credited the fix in the Chromium issue tracker entry 513156160. The vulnerability affects Chrome installations on Windows, macOS, and Linux.

Critical Impact
Successful exploitation enables sandbox escape from a compromised renderer process, allowing attacker code to break out of Chrome's process isolation boundary and execute with broader privileges on the host operating system.

Affected Products

Google Chrome versions prior to 149.0.7827.103
Chrome desktop builds on Microsoft Windows
Chrome desktop builds on Apple macOS and Linux

Discovery Timeline

2026-06-09 - CVE-2026-11652 published to NVD
2026-06-09 - Last updated in NVD database
2026-06-09 - Google releases Stable channel update for desktop containing the fix

Technical Details for CVE-2026-11652

Vulnerability Analysis

The flaw is a use-after-free condition within Chrome's Extensions subsystem. Use-after-free bugs occur when memory is freed but a dangling pointer to that memory is later dereferenced. An attacker who controls the reused allocation can manipulate object state to redirect control flow or corrupt internal browser structures.

In this case, the bug resides in code reachable from the privileged browser process side of the extension interface. A compromised renderer can issue crafted messages or trigger lifecycle events that free an extension-related object while a reference is still held. The resulting dangling pointer can then be steered into attacker-controlled memory.

The vulnerability requires user interaction and presents high attack complexity, but the scope is changed because exploitation crosses the renderer-to-browser sandbox boundary. A successful chain breaks Chrome's site isolation guarantees and grants the attacker the privileges of the browser process.

Root Cause

The root cause is improper lifetime management of an object accessed by the Extensions component. The owning code releases the allocation without invalidating all outstanding pointers, so a subsequent operation reads or writes freed heap memory. This pattern is tracked under CWE-416 (Use After Free).

Attack Vector

Exploitation begins with the attacker first compromising the renderer process, typically through a separate memory corruption bug triggered by a crafted HTML page. From that foothold, the attacker drives the Extensions interface to trigger the use-after-free and pivots out of the sandbox. The attack is network-reachable because the initial HTML payload can be delivered through any visited web page.

No public proof-of-concept, exploit code, or CISA KEV listing is associated with this CVE at the time of publication. See the Chromium Issue Tracker Entry for additional technical context.

Detection Methods for CVE-2026-11652

Indicators of Compromise

Chrome renderer or browser process crashes referencing extension-related call stacks or freed heap allocations
Unexpected child processes spawned by chrome.exe following navigation to untrusted web content
Outbound connections from the Chrome browser process to unfamiliar hosts shortly after rendering an external HTML page
Chrome installations reporting a version string lower than 149.0.7827.103 in managed inventories

Detection Strategies

Inventory all endpoints for Chrome versions below 149.0.7827.103 using endpoint management or EDR telemetry
Hunt for anomalous process trees where Chrome spawns shells, scripting hosts, or LOLBins after web browsing activity
Correlate Chrome crash reports with network telemetry to identify pages that reliably trigger renderer failures

Monitoring Recommendations

Enable Chrome enterprise crash and telemetry reporting to surface repeated renderer or browser crashes
Monitor extension installation events and inspect any extensions added outside the corporate allowlist
Track endpoint patch compliance for browser updates and alert on hosts that remain on unpatched Chrome builds for more than 48 hours

How to Mitigate CVE-2026-11652

Immediate Actions Required

Update Google Chrome to version 149.0.7827.103 or later on all Windows, macOS, and Linux endpoints
Restart browsers after the update so the patched binaries take effect on running sessions
Audit installed Chrome extensions and remove any that are unsigned, unmaintained, or not required for business use
Enforce automatic browser updates through Chrome Browser Cloud Management or equivalent group policy

Patch Information

Google published the fix in the Stable channel update for desktop. Apply Chrome 149.0.7827.103 or later. Refer to the Google Chrome Update Announcement for the full release notes and additional CVEs addressed in the same update.

Workarounds

Restrict extension installation to an enterprise-managed allowlist using the ExtensionInstallAllowlist and ExtensionInstallBlocklist policies
Block end-user access to untrusted sites through web filtering until patching is complete
Disable third-party extensions on high-value endpoints where browser-based access to sensitive systems occurs

bash

# Example Chrome enterprise policy enforcing minimum version and extension allowlist
# Linux: /etc/opt/chrome/policies/managed/cve-2026-11652.json
{
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": [
    "<approved-extension-id-1>",
    "<approved-extension-id-2>"
  ],
  "BrowserSwitcherEnabled": false,
  "ComponentUpdatesEnabled": true,
  "DefaultBrowserSettingEnabled": true
}