CVE-2026-11657 Overview
CVE-2026-11657 is a use-after-free vulnerability in the Payments component of Google Chrome on macOS. The flaw affects Chrome versions prior to 149.0.7827.103 and is tracked as [CWE-416]. A remote attacker can exploit the issue by serving a crafted HTML page to a targeted user. Successful exploitation leads to arbitrary code execution within the browser process context. Google classifies the Chromium security severity as High, and the issue is tracked in the Chromium Issue Tracker.
Critical Impact
Remote attackers can achieve arbitrary code execution on macOS systems running vulnerable Chrome builds when a user visits a malicious page.
Affected Products
- Google Chrome on macOS prior to 149.0.7827.103
- Apple macOS hosts running affected Chrome builds
- Chromium-derived browsers that ship the vulnerable Payments code path
Discovery Timeline
- 2026-06-09 - CVE-2026-11657 published to the National Vulnerability Database
- 2026-06-09 - Google publishes the Stable Channel Update for Desktop
- 2026-06-09 - Record last modified in NVD
Technical Details for CVE-2026-11657
Vulnerability Analysis
The vulnerability resides in the Payments component of Google Chrome on macOS. Use-after-free flaws occur when memory is referenced after it has been freed, creating an opportunity for attackers to control the freed allocation. In a browser renderer context, this typically translates into arbitrary code execution within the sandboxed process. The Payments subsystem handles structured input from web pages, including the Payment Request API and related autofill flows, which exposes the affected object lifecycle to attacker-controlled JavaScript.
Exploitation requires user interaction, since the victim must load attacker-controlled content. No authentication is required, and the attack is delivered over the network through standard web navigation or embedded iframes.
Root Cause
The root cause is improper object lifetime management in the Payments component. A reference to a previously released object persists across asynchronous operations, allowing subsequent code paths to operate on dangling memory. The exact internal object is described in the Chromium Issue Tracker entry, which remains access-restricted while users patch.
Attack Vector
An attacker hosts a crafted HTML page that invokes Payments-related APIs in a sequence that triggers the freed-object reuse. When a Chrome user on macOS visits the page, the renderer dereferences the dangling pointer. Combined with a renderer-to-host escape or memory primitive, the attacker can execute arbitrary code in the affected process. The attack does not require credentials and can be delivered through phishing links, malvertising, or compromised sites.
No public proof-of-concept exploit is available at the time of publication, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2026-11657
Indicators of Compromise
- Chrome renderer process crashes referencing the Payments component or payments:: symbols in macOS crash reports under ~/Library/Logs/DiagnosticReports/
- Outbound connections from Chrome to newly observed or low-reputation domains immediately followed by child process creation
- Unexpected child processes spawned by Google Chrome Helper (Renderer) on macOS endpoints
Detection Strategies
- Inventory Chrome versions across macOS fleets and alert on any build below 149.0.7827.103
- Monitor EDR telemetry for anomalous process lineage descending from Chrome helper processes
- Correlate browser crash events with subsequent network or persistence activity to identify post-exploitation behavior
Monitoring Recommendations
- Ingest Chrome update and version telemetry into the SIEM to track patch compliance over time
- Track web proxy and DNS logs for users visiting unclassified domains shortly before Chrome crash events
- Enable macOS Endpoint Security framework events for process execution and file writes by Chrome helpers
How to Mitigate CVE-2026-11657
Immediate Actions Required
- Update Google Chrome on all macOS endpoints to version 149.0.7827.103 or later
- Restart Chrome after the update so the patched binary is loaded into memory
- Verify deployment through managed software distribution tools and audit non-compliant hosts
Patch Information
Google addressed the vulnerability in the Stable channel release announced on June 9, 2026. The fixed version is Chrome 149.0.7827.103 for macOS. Details are documented in the Google Chrome Releases blog. Chromium-based browsers should adopt the corresponding upstream fix from the Chromium project.
Workarounds
- Restrict browsing to trusted sites until the patch is deployed, using web filtering or DNS-layer controls
- Disable the Payment Request API through enterprise policy where business workflows permit
- Enforce Site Isolation and Enhanced Safe Browsing through Chrome enterprise policies to reduce exploit reliability
# Verify the installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version
# Force an update check via the Chrome update agent
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin --print
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
