CVE-2026-11664: Google Chrome Use After Free Vulnerability

CVE-2026-11664 Overview

CVE-2026-11664 is a use-after-free vulnerability in the Payments component of Google Chrome versions prior to 149.0.7827.103. A remote attacker can trigger heap corruption by enticing a user to visit a crafted HTML page. The flaw is classified under CWE-416: Use After Free and affects Chrome on Windows, macOS, and Linux. Google rates the Chromium security severity as High. Successful exploitation can lead to arbitrary code execution within the renderer process and may be chained with a sandbox escape for broader system compromise.

Critical Impact
Remote attackers can exploit heap corruption through a crafted web page, potentially achieving code execution in the renderer process after a single user interaction.

Affected Products

Google Chrome versions prior to 149.0.7827.103
Chrome on Microsoft Windows
Chrome on Apple macOS and Linux

Discovery Timeline

2026-06-09 - CVE-2026-11664 published to NVD
2026-06-09 - Last updated in NVD database
2026-06 - Google releases Stable Channel update for Desktop addressing the issue (see Chrome Release Update)

Technical Details for CVE-2026-11664

Vulnerability Analysis

The vulnerability resides in Chrome's Payments subsystem, which handles the PaymentRequest API and related browser-mediated payment flows. A use-after-free condition occurs when the Payments code continues to reference a heap object after that object has been freed. An attacker who controls the lifecycle of payment-related objects through scripted DOM operations can manipulate Chrome into dereferencing a dangling pointer.

Once the freed memory is reclaimed with attacker-controlled data, the use-after-free can be converted into a controlled write or virtual function call. This yields heap corruption suitable for arbitrary code execution within the renderer process. Combined with a separate sandbox escape, the bug becomes a full system compromise primitive. Google's tracking entry is available at the Chromium Issue Tracker.

Root Cause

The root cause is improper object lifetime management in the Payments component. Code paths release a heap-allocated object while another reference remains live and is later dereferenced. This pattern, classified as CWE-416, is recurrent in browser components that mix asynchronous callbacks with reference counting and Mojo IPC bindings.

Attack Vector

Exploitation requires a victim to load attacker-controlled HTML in a vulnerable Chrome build. The crafted page invokes Payments APIs in a sequence that triggers premature object destruction, then sprays the heap to control the freed slot. The vulnerability is network-reachable and requires user interaction such as visiting a link or loading a malicious advertisement on a compromised site.

The vulnerability is described in prose only because no public proof-of-concept code is available. Refer to the Chromium Issue Tracker for any details Google chooses to release after broad patch deployment.

Detection Methods for CVE-2026-11664

Indicators of Compromise

Renderer process crashes referencing the Payments component or payments:: symbols in crash reports.
Outbound connections from Chrome renderer processes to unexpected domains following visits to untrusted sites.
Chrome child processes spawning shells, rundll32.exe, or other living-off-the-land binaries.

Detection Strategies

Inventory Chrome installations and flag any build below 149.0.7827.103 across Windows, macOS, and Linux endpoints.
Correlate browser crash telemetry with web proxy logs to identify users who landed on suspicious pages immediately before a renderer fault.
Hunt for anomalous process trees where chrome.exe (or Google Chrome Helper (Renderer) on macOS) spawns scripting interpreters or persistence-related binaries.

Monitoring Recommendations

Forward Chrome crash dumps and EDR process telemetry to a central data lake for retrospective hunting.
Monitor for execution of new or unsigned binaries written by Chrome processes to user-writable directories.
Track DNS and HTTP traffic from browser hosts for connections to newly registered or low-reputation domains tied to known exploit kits.

How to Mitigate CVE-2026-11664

Immediate Actions Required

Update Google Chrome to version 149.0.7827.103 or later on all managed Windows, macOS, and Linux endpoints.
Force a Chrome relaunch after the update so that the patched binary is loaded into memory.
Audit Chromium-based browsers and embedded frameworks (Electron, CEF) for downstream patches incorporating the same fix.

Patch Information

Google addressed CVE-2026-11664 in the Chrome Stable Channel release documented in the Chrome Release Update. Enterprises using managed updates should validate that the Chrome update policy is set to automatic and that the rollout has reached every endpoint. Detailed bug references are available in the Chromium Issue Tracker.

Workarounds

Block access to untrusted sites via web proxy or DNS filtering until patching completes.
Restrict use of the PaymentRequest API through enterprise policy where business workflows do not require it.
Enable Chrome's Site Isolation and Enhanced Safe Browsing to raise the cost of renderer exploitation.

bash

# Verify the installed Chrome version on Linux/macOS
google-chrome --version

# Windows: query the installed version from the registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv