CVE-2026-11663: Google Chrome Use-After-Free Vulnerability

CVE-2026-11663 Overview

CVE-2026-11663 is a use-after-free vulnerability in the Skia graphics library used by Google Chrome versions prior to 149.0.7827.103. The flaw allows a remote attacker who has already compromised the renderer process to potentially escape the Chrome sandbox using a crafted HTML page. Google classifies the Chromium security severity as High, and the issue is tracked under CWE-416. Exploitation requires user interaction with a malicious page and chained compromise of the renderer, raising the attack complexity. Google addressed the vulnerability in the Stable channel update for desktop announced on the Chrome Releases blog.

Critical Impact
Successful exploitation enables a sandbox escape from a compromised renderer process, allowing attacker-controlled code to run outside Chrome's isolation boundary on Windows, macOS, and Linux hosts.

Affected Products

Google Chrome versions prior to 149.0.7827.103
Chromium-based browsers on Microsoft Windows, Apple macOS, and Linux that embed the affected Skia component
Downstream Chromium derivatives that have not rebased to the patched Skia revision

Discovery Timeline

2026-06-09 - CVE-2026-11663 published to the National Vulnerability Database
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-11663

Vulnerability Analysis

The vulnerability resides in Skia, the 2D graphics library Chrome uses to rasterize web content, canvas operations, and compositor layers. A use-after-free condition occurs when Skia code references a heap object after it has been freed, allowing an attacker to reclaim the freed allocation with controlled data. Because Skia executes inside the renderer process and interacts with the GPU process across shared memory boundaries, control of a freed Skia object can be leveraged to corrupt structures that survive the sandbox layer. The Chromium team treats this issue as a sandbox escape primitive rather than a standalone renderer exploit, meaning it must be chained with a prior renderer compromise. The condition is documented in the Chromium Issue Tracker.

Root Cause

The root cause is improper object lifetime management in Skia [CWE-416]. Code paths reachable from a crafted HTML page release a graphics object while another reference remains live, and subsequent operations dereference the dangling pointer. Attackers spray the heap to place attacker-controlled data into the freed slot, turning the stale reference into a controlled read or write.

Attack Vector

The attack vector is network-based and requires user interaction. A victim must load a malicious or compromised web page that already exploits a separate renderer vulnerability. Once the renderer is compromised, the attacker triggers the Skia code path that frees and then reuses the target object, then pivots the corruption into code execution outside the renderer sandbox.

No public proof-of-concept exploit is available, and no entries exist in Exploit-DB or the CISA Known Exploited Vulnerabilities catalog as of publication.

Detection Methods for CVE-2026-11663

Indicators of Compromise

Chrome renderer or GPU process crashes referencing Skia symbols such as SkCanvas, SkSurface, or GrDirectContext in crash reports
Unexpected child processes spawned by chrome.exe, Google Chrome Helper, or chrome on Linux following browsing of untrusted sites
Outbound network connections initiated by Chrome helper processes to attacker-controlled infrastructure shortly after page loads

Detection Strategies

Monitor endpoint telemetry for Chrome processes performing process injection, token manipulation, or writing executables to disk
Correlate browser crash dumps containing Skia stack frames with subsequent suspicious process activity on the same host
Inspect HTTP responses for HTML pages that combine WebGL, Canvas2D, and aggressive JavaScript heap manipulation patterns consistent with renderer exploit chains

Monitoring Recommendations

Track installed Chrome versions across the fleet and alert on any host running a build earlier than 149.0.7827.103
Forward Chrome crash telemetry and Windows Error Reporting events to a central log store for retroactive hunting
Enable browser process command-line and child-process logging via EDR to surface sandbox escape attempts in near real time

How to Mitigate CVE-2026-11663

Immediate Actions Required

Update Google Chrome to version 149.0.7827.103 or later on all Windows, macOS, and Linux endpoints
Restart browser sessions after the update so the patched Skia binary is loaded into every renderer and GPU process
Audit Chromium-based browsers and embedded webviews and apply vendor updates that incorporate the fixed Skia revision

Patch Information

Google released the fix in the Stable channel desktop update covering Chrome 149.0.7827.103 and later. Administrators should consult the Google Chrome Update Announcement for the complete list of CVEs addressed in the same release and validate enterprise update channels are pulling the new build.

Workarounds

Enforce automatic Chrome updates through enterprise policy so users cannot defer the patched build
Restrict browsing of untrusted sites from privileged workstations until patching completes
Deploy site isolation and strict same-origin policies, which raise the cost of chaining a renderer exploit with this Skia flaw

bash

# Verify Chrome version meets the patched baseline on Linux
google-chrome --version | awk '{print $3}' | \
  awk -F. '{ if ($1<149 || ($1==149 && $3<7827)) print "VULNERABLE"; else print "PATCHED" }'

# Windows: query installed Chrome version via registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv