CVE-2026-11671: Google Chrome Use After Free Vulnerability

CVE-2026-11671 Overview

CVE-2026-11671 is a use-after-free vulnerability [CWE-416] in the Navigation component of Google Chrome versions prior to 149.0.7827.103. A remote attacker can exploit the flaw by serving a crafted HTML page to a targeted user. Successful exploitation may lead to a sandbox escape, allowing attacker-controlled code to break out of Chrome's renderer sandbox. The issue affects Chrome on Windows, macOS, and Linux. Google rates the Chromium security severity as High, and the NVD CVSS 3.1 base score is 9.6.

Critical Impact
Remote attackers can trigger memory corruption via a malicious web page and potentially escape the Chrome sandbox, gaining the ability to execute code outside the renderer's restricted context.

Affected Products

Google Chrome versions prior to 149.0.7827.103
Chrome desktop builds on Microsoft Windows and Apple macOS
Chrome desktop builds on Linux distributions

Discovery Timeline

2026-06-09 - CVE-2026-11671 published to NVD
2026-06-09 - Last updated in NVD database
2026-06 - Google releases Stable Channel Update for Desktop addressing the issue (Google Chrome Update Announcement)

Technical Details for CVE-2026-11671

Vulnerability Analysis

The flaw resides in Chrome's Navigation logic, which manages page transitions, frame lifecycle, and document loading. A use-after-free condition occurs when the browser retains a reference to a navigation-related object after that object has been freed. When the dangling pointer is dereferenced, an attacker controlling the freed memory region can influence program flow.

Because Navigation handling spans the renderer process and the browser process, corruption of the wrong object during a navigation event can be leveraged to cross trust boundaries. The advisory states the bug allows a remote attacker to potentially perform a sandbox escape. A sandbox escape elevates a renderer-level compromise into code execution in the higher-privilege browser process, removing the isolation Chrome relies on to contain malicious web content.

Exploitation requires user interaction — a victim must visit or be redirected to an attacker-controlled page — but no authentication is needed. The scope is changed because impact extends beyond the vulnerable renderer into the browser process and underlying operating system.

Root Cause

The root cause is improper object lifetime management in the Navigation subsystem. A pointer to a navigation entry or associated document object continues to be used after the underlying allocation has been released. Attackers can race or shape allocations to place controlled data into the freed slot, turning the stale reference into a primitive for memory disclosure or control-flow hijacking.

Attack Vector

Attack delivery occurs over the network through a crafted HTML page. Typical delivery channels include phishing links, watering-hole websites, malicious advertisements, or compromised legitimate sites. The page triggers a specific navigation sequence — such as rapid frame creation and destruction, history manipulation, or cross-origin transitions — that exposes the use-after-free condition. See the Chromium Issue Tracker Entry for technical references.

Detection Methods for CVE-2026-11671

Indicators of Compromise

Chrome renderer or browser process crashes referencing navigation, frame, or document objects in crash dumps.
Unexpected child processes spawned by chrome.exe, such as command shells, scripting hosts, or rundll32.exe.
Outbound connections from Chrome processes to newly registered or low-reputation domains immediately after page loads.
Creation of persistence artifacts (scheduled tasks, run keys, LaunchAgents) following a browsing session.

Detection Strategies

Inventory Chrome installations across the fleet and flag any version below 149.0.7827.103.
Hunt for anomalous process trees where Chrome spawns non-browser binaries, a common post-sandbox-escape behavior.
Correlate browser crash telemetry with web proxy logs to identify pages that consistently trigger renderer faults.
Apply web filtering and URL reputation checks to block known malicious pages used in browser exploitation chains.

Monitoring Recommendations

Forward Chrome version data and crash reports into a centralized SIEM for continuous version-compliance monitoring.
Alert on Chrome processes performing file writes to autostart locations or executing LOLBins.
Monitor egress traffic from browser processes for unusual binary downloads or non-HTTP protocols.

How to Mitigate CVE-2026-11671

Immediate Actions Required

Update Google Chrome to version 149.0.7827.103 or later on all Windows, macOS, and Linux endpoints.
Force-restart Chrome after the update so the patched binaries are loaded; running instances continue to use the vulnerable code.
Verify enterprise update channels (Google Update, MDM, package managers) are functional and not blocked by policy.
Audit Chromium-based embedded browsers and Electron applications for downstream patches.

Patch Information

Google addressed the issue in the Stable Channel Update for Desktop, shipping Chrome 149.0.7827.103. Administrators should consult the Google Chrome Update Announcement for rollout details and the Chromium Issue Tracker Entry for technical references. No exploit is publicly available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at this time.

Workarounds

Restrict browsing to trusted sites using enterprise URL allowlists until patching completes.
Deploy Chrome enterprise policies that disable unnecessary features and enforce Site Isolation.
Educate users to avoid clicking unsolicited links and to report unexpected browser crashes to security teams.

bash

# Verify installed Chrome version on Linux/macOS
google-chrome --version
# Expected output: Google Chrome 149.0.7827.103 or later

# Windows (PowerShell)
(Get-Item "$env:ProgramFiles\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion