CVE-2026-11660: Google Chrome RCE Vulnerability

CVE-2026-11660 Overview

CVE-2026-11660 affects Google Chrome versions prior to 149.0.7827.103. The vulnerability stems from insufficient validation of untrusted input in the New Tab Page component [CWE-20]. A remote attacker who has already compromised the renderer process can leverage a crafted HTML page to escape the Chromium sandbox. Sandbox escape vulnerabilities are particularly significant because they break the security boundary that isolates web content from the host operating system. Google has rated the Chromium security severity as High and addressed the issue in the stable channel desktop release.

Critical Impact
Successful exploitation chains the renderer compromise with a sandbox escape, granting the attacker code execution outside the browser's restricted process boundary.

Affected Products

Google Chrome versions prior to 149.0.7827.103
Chrome on Microsoft Windows
Chrome on Apple macOS and Linux

Discovery Timeline

2026-06-09 - CVE-2026-11660 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-11660

Vulnerability Analysis

The defect resides in the New Tab Page (NTP) surface of Google Chrome. The NTP processes untrusted input without sufficient validation, creating a pathway that a compromised renderer can abuse. Because the NTP is implemented with privileged WebUI components, weak input handling on this surface can expose interfaces normally unreachable from regular web content. The bug is classified as Improper Input Validation [CWE-20]. The attack is not a single-stage drive-by exploit. It assumes a prior renderer compromise, and the NTP flaw provides the second-stage primitive needed to break the sandbox. The EPSS score is 0.106% with a percentile of 28.259, reflecting limited public exploitation signal at publication time.

Root Cause

The root cause is insufficient validation of input crossing from web-content contexts into the New Tab Page handling logic. When untrusted data reaches privileged code paths without proper sanitization or origin checks, the renderer process can manipulate state or invoke functionality that should remain isolated from compromised contexts.

Attack Vector

The attacker delivers a crafted HTML page to a victim and must first compromise the renderer process. From the compromised renderer, the attacker interacts with the New Tab Page input surface to trigger the validation flaw and execute code outside the sandbox. User interaction is required, and attack complexity is High because the chain depends on a working renderer exploit. No verified public proof-of-concept code is available. See the Chromium Issue Tracker entry for technical context once Google opens the bug.

Detection Methods for CVE-2026-11660

Indicators of Compromise

Chrome browser processes spawning unexpected child processes outside the standard renderer or utility sandbox profile.
Outbound connections to attacker-controlled domains immediately after rendering pages that invoke chrome://newtab resources.
Unsigned or unusual binaries written to user profile directories following Chrome activity.

Detection Strategies

Inventory Chrome installations across managed endpoints and flag any version below 149.0.7827.103.
Hunt for anomalous process trees rooted in chrome.exe that bypass typical sandbox child relationships.
Correlate browser telemetry with file write and network egress events to detect post-exploitation behavior.

Monitoring Recommendations

Enable enterprise browser telemetry forwarding to your SIEM and retain renderer and NTP-related events.
Monitor for unexpected modifications to Chrome preferences, extensions directories, and persistence locations.
Alert on Chrome processes invoking shell interpreters, scripting hosts, or LOLBins.

How to Mitigate CVE-2026-11660

Immediate Actions Required

Update Google Chrome to version 149.0.7827.103 or later on all Windows, macOS, and Linux endpoints.
Force-restart Chrome after deployment to ensure the patched binaries are loaded into memory.
Validate patch coverage by querying installed versions through endpoint management tooling.

Patch Information

Google released the fix in the stable channel desktop update. Refer to the Google Chrome Stable Update advisory for distribution details. Enterprises using managed update channels should confirm rollout policies push 149.0.7827.103 or newer.

Workarounds

Enforce automatic Chrome updates through Group Policy or MDM to remove version drift on managed fleets.
Restrict navigation to untrusted sites via enterprise browsing policies until patch compliance is verified.
Apply site isolation and strict sandboxing flags, and disable unnecessary browser extensions that broaden the attack surface.

bash

# Verify installed Chrome version on Linux
google-chrome --version

# Windows: query installed version via registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# macOS: read version from Info.plist
defaults read "/Applications/Google Chrome.app/Contents/Info" CFBundleShortVersionString