CVE-2026-11674: Google Chrome Use After Free Vulnerability

CVE-2026-11674 Overview

CVE-2026-11674 is a use-after-free vulnerability [CWE-416] in the Guest View component of Google Chrome prior to version 149.0.7827.103. A remote attacker can execute arbitrary code inside the renderer sandbox by enticing a user to visit a crafted HTML page. Google has rated the Chromium security severity as High, and the issue affects Chrome on Windows, macOS, and Linux. The flaw requires user interaction, but no authentication, making drive-by browsing attacks a realistic delivery method.

Critical Impact
Successful exploitation lets a remote attacker run arbitrary code inside the Chrome sandbox through a single crafted web page, providing a foothold for chained sandbox escapes.

Affected Products

Google Chrome versions prior to 149.0.7827.103
Chrome desktop builds on Microsoft Windows, Apple macOS, and Linux
Chromium-based browsers that embed the affected Guest View code path

Discovery Timeline

2026-06-09 - CVE-2026-11674 published to the National Vulnerability Database
2026-06-09 - Last updated in the NVD database

Technical Details for CVE-2026-11674

Vulnerability Analysis

The vulnerability resides in Chrome's Guest View implementation, the subsystem that hosts embedded content such as <webview> and <iframe>-style guest documents used by extensions and the browser shell. Guest View manages the lifecycle of guest WebContents instances and coordinates message routing between the embedder and the guest.

A use-after-free condition arises when an object tied to a guest view is freed while another code path still holds a dangling reference. Subsequent operations on the freed object dereference attacker-influenced memory. Because Guest View runs in the renderer process, exploitation yields code execution inside the renderer sandbox rather than the broader operating system.

The Chromium issue tracker entry Chromium Issue 516910450 is restricted while users patch. The fix shipped in the Stable Channel update for desktop.

Root Cause

The root cause is improper lifetime management of an object referenced by Guest View. A reference outlives the owning object, producing a dangling pointer. When the renderer accesses that pointer, attacker-controlled heap data can be interpreted as a valid object, enabling control-flow hijack within the renderer.

Attack Vector

Exploitation is network-based and requires user interaction. The attacker hosts a crafted HTML page that triggers the freed-object access through scripted manipulation of guest view content. Phishing, malvertising, or watering-hole delivery are all viable. No code example is published; technical specifics remain restricted in the Chromium issue tracker pending broad patch deployment.

Detection Methods for CVE-2026-11674

Indicators of Compromise

Chrome renderer process crashes referencing Guest View, WebViewGuest, or MimeHandlerViewGuest in crash dumps
Outbound connections from Chrome to newly registered or low-reputation domains shortly before unexpected child-process spawns
Persistence artifacts created by chrome.exe child processes following visits to untrusted HTML content

Detection Strategies

Inventory Chrome versions across the fleet and alert on any instance below 149.0.7827.103
Monitor process trees for anomalous children of chrome.exe, particularly script interpreters or LOLBins launched from the browser
Hunt for renderer sandbox escape patterns by correlating Chrome crashes with subsequent suspicious file or registry writes

Monitoring Recommendations

Forward Chrome crash telemetry and browser version data to a central analytics platform for version-compliance reporting
Apply web-proxy logging to identify users reaching unfamiliar HTML payloads delivered via ads or redirects
Enable EDR behavioral rules that flag in-memory code execution patterns originating from browser renderer processes

How to Mitigate CVE-2026-11674

Immediate Actions Required

Update Google Chrome to version 149.0.7827.103 or later on Windows, macOS, and Linux endpoints
Restart browsers after deployment to ensure the patched binary is loaded by all sessions
Audit Chromium-based browsers and embedded WebView frameworks for downstream patches incorporating the same fix

Patch Information

Google released the fix in the Stable Channel update referenced in the Google Chrome Update Announcement. Enterprises should use managed update channels or group policy to force the new version. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, and the EPSS probability is low, but the High Chromium severity rating warrants prompt patching.

Workarounds

Restrict use of browser extensions and applications that rely on <webview> guest content until patching is complete
Enforce strict web filtering to block uncategorized and newly observed domains for high-risk user groups
Apply browser policy to disable third-party iframes on sensitive internal portals where feasible

bash

# Verify installed Chrome version on Windows, macOS, and Linux
# Windows (PowerShell)
(Get-Item "$env:ProgramFiles\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Linux
google-chrome --version

# Confirm output is 149.0.7827.103 or higher