CVE-2026-11673: Google Chrome Use-After-Free Vulnerability

CVE-2026-11673 Overview

CVE-2026-11673 is a use-after-free vulnerability [CWE-416] in the InterestGroups component of Google Chrome prior to version 149.0.7827.103. A remote attacker can trigger memory corruption by serving a crafted HTML page to a vulnerable browser. Successful exploitation allows arbitrary code execution inside the Chrome renderer sandbox. The flaw affects Chrome installations on Windows, macOS, and Linux. Google rates the Chromium security severity as High and addressed the issue in the stable channel update referenced in the Google Chrome Stable Update advisory.

Critical Impact
Remote attackers can execute arbitrary code within the Chrome renderer sandbox by luring a user to a malicious web page, providing a foothold for sandbox escape chains.

Affected Products

Google Chrome prior to 149.0.7827.103
Chrome installations on Microsoft Windows
Chrome installations on Apple macOS and Linux

Discovery Timeline

2026-06-09 - CVE-2026-11673 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-11673

Vulnerability Analysis

The vulnerability resides in Chrome's InterestGroups implementation, part of the Protected Audience API (formerly FLEDGE) used for on-device ad auctions. The component manages interest group objects that persist across renderer operations and asynchronous auction callbacks. A use-after-free condition arises when a referenced InterestGroups object is freed while another execution path retains a dangling pointer to its memory. When the stale pointer is dereferenced, attacker-controlled data placed at the reclaimed allocation determines control flow.

Exploitation occurs entirely through a crafted HTML page. The attacker does not need privileges or credentials on the target system. User interaction is limited to visiting the page, which is the default browsing model. Successful exploitation yields code execution constrained to the renderer sandbox, which is typically chained with a separate sandbox escape to achieve full system compromise.

Root Cause

The root cause is improper lifetime management of an InterestGroups object [CWE-416]. Chrome releases the underlying allocation before all references to it are cleared, leaving at least one path that operates on freed memory.

Attack Vector

The attack vector is network-based. An attacker hosts a malicious page that invokes the Protected Audience API surface in a sequence that triggers the freed-object access. Cross-origin iframes, malvertising, and compromised legitimate sites are all viable delivery mechanisms. See the Chromium Issue Tracker #516902973 for additional technical context.

No public proof-of-concept code has been released, and no exploitation in the wild has been reported.

Detection Methods for CVE-2026-11673

Indicators of Compromise

Chrome renderer process crashes referencing InterestGroups, AdAuction, or Protected Audience API frames in crash dumps.
Unexpected child process spawns from chrome.exe following navigation to untrusted domains.
Outbound connections from renderer processes to recently registered or low-reputation domains hosting auction logic.

Detection Strategies

Inventory Chrome versions across the fleet and flag any endpoint running a build earlier than 149.0.7827.103.
Hunt for browser exploitation behaviors: renderer-spawned shells, suspicious memory allocations, and unexpected file writes from Chrome child processes.
Correlate web proxy logs with endpoint telemetry to identify users visiting URLs that subsequently trigger Chrome crashes.

Monitoring Recommendations

Enable browser crash reporting and forward dumps to a central analysis pipeline for triage.
Monitor process lineage from chrome.exe for anomalous descendants such as cmd.exe, powershell.exe, or bash.
Track Chrome version drift through endpoint management tooling and alert on stalled updates.

How to Mitigate CVE-2026-11673

Immediate Actions Required

Update Google Chrome to version 149.0.7827.103 or later on all Windows, macOS, and Linux endpoints.
Restart Chrome after the update to ensure the patched binary is loaded across all renderer processes.
Audit Chromium-based browsers (Edge, Brave, Opera, Vivaldi) and apply vendor updates that incorporate the upstream fix.

Patch Information

Google released the fix in the Chrome stable channel update documented in the Google Chrome Stable Update advisory. Enterprise administrators should deploy version 149.0.7827.103 or newer through managed update channels and verify rollout completion.

Workarounds

Where patching is delayed, disable the Protected Audience API via enterprise policy to remove the vulnerable attack surface.
Restrict access to untrusted web content through web filtering or browser isolation until updates are applied.
Enforce site isolation and ensure the renderer sandbox remains enabled, which limits the impact of successful exploitation.

bash

# Verify Chrome version on Linux/macOS
google-chrome --version

# Windows: query installed version via registry
reg query "HKLM\Software\Google\Chrome\BLBeacon" /v version

# Enterprise policy example (Windows registry) to disable Protected Audience API
reg add "HKLM\Software\Policies\Google\Chrome" /v PrivacySandboxAdsAPIsEnabled /t REG_DWORD /d 0 /f