Use after free in Fonts in Google Chrome on Linux prior to 149

CVE-2026-11000 is a use-after-free in Chrome's Fonts handling on Linux. A victim must browse to a crafted HTML page, which can trigger memory corruption and let attacker-controlled code run inside the sandboxed renderer. Affected builds are Google Chrome on Linux before 149.0.7827.53; the fixed Linux stable build is 149.0.7827.53.

The scary part is the word *RCE*, but the important qualifier is inside a sandbox. In practice that means this bug is usually stage 1 of a chain, not full host compromise by itself. The supplied 8.8/High baseline overstates enterprise urgency for most fleets; Chrome's own June 2, 2026 release notes list this issue as Medium, which better matches the real-world friction: Linux-only, user interaction required, renderer confinement, no KEV, and extremely low EPSS.

Why this verdict

• Downgrade from 8.8/High: the attacker gets code execution inside a sandboxed renderer, not a clean workstation takeover
• UI:R is real friction: the bug needs the victim to load attacker content, which implies phishing, malvertising, or site compromise rather than unauthenticated direct reachability
• Linux-only narrows population: many enterprise fleets have smaller Linux desktop/browser footprints, so the exposed population is materially lower than a cross-platform Chrome bug
• No KEV, no public exploitation, very low EPSS: there is no current evidence this is being broadly weaponized in the wild
• Chrome itself tagged it Medium: the vendor release notes classify this specific flaw as Medium, aligning with the practical constraints better than the raw CVSS math

Why not higher?

Because this CVE stops at sandboxed renderer execution. To turn it into meaningful host compromise, an attacker usually needs a second bug, a weakened sandbox posture, or some separate post-renderer abuse path; that missing link is exactly why this should not sit in the same queue as true pre-auth remote workstation takeover bugs.

Why not lower?

Because it is still a remote browser memory-corruption flaw in a widely used application class, and those bugs do get chained. If you run Linux engineering workstations, admins, or internet-facing browsing personas, the risk is not trivial even without current exploitation evidence.

1. Block unsafe browser launch flags — Hunt for and prohibit Chrome starts with --no-sandbox or similar weakening flags via endpoint controls and hardening baselines. That matters immediately because the biggest severity reduction here comes from the sandbox; for a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but this control should stay permanent.
2. Constrain Linux browser egress — Apply role-based web filtering, DNS filtering, and category blocks on Linux endpoints used for admin or developer browsing. This reduces the only practical initial access route—delivery of a crafted page—and is worth keeping if patch rollout lags; again, no mitigation SLA applies for a MEDIUM verdict.
3. Prioritize high-risk Linux user groups — If you cannot patch the whole Linux fleet at once, identify developers, security staff, and privileged admins who browse from Linux desktops and move them first. The risk is user-driven and browser-local, so narrowing exposure on those personas gives better return than blind fleetwide panic patching.
4. Use browser version telemetry — Drive verification from package inventory, managed browser telemetry, or EDR software inventory rather than network scans. This is the only scalable way to prove exposure for a browser CVE across a 10,000-host estate.

Run this on the target Linux endpoint or through your EDR/script runner. Invoke it as bash chrome_cve_2026_11000_check.sh; it needs only normal user rights to read executable versions, though root may help if you're checking package metadata on locked-down hosts. The script reports VULNERABLE, PATCHED, or UNKNOWN and exits 1, 0, or 2 respectively.

#!/usr/bin/env bash
# Check exposure to CVE-2026-11000 on Linux Chrome/Chromium endpoints.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

FIXED_VERSION="149.0.7827.53"

have_cmd() {
  command -v "$1" >/dev/null 2>&1
}

extract_version() {
  # Pull first dotted quad version from arbitrary text.
  echo "$1" | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | head -n1
}

version_ge() {
  # Returns 0 if $1 >= $2 using sort -V semantics.
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | tail -n1)" = "$1" ]
}

get_browser_version() {
  local out=""

  for bin in google-chrome google-chrome-stable chromium chromium-browser chrome; do
    if have_cmd "$bin"; then
      out="$($bin --version 2>/dev/null || true)"
      v="$(extract_version "$out")"
      if [ -n "${v:-}" ]; then
        echo "$bin|$v|binary"
        return 0
      fi
    fi
  done

  if have_cmd dpkg-query; then
    for pkg in google-chrome-stable chromium chromium-browser; do
      out="$(dpkg-query -W -f='${Version}\n' "$pkg" 2>/dev/null || true)"
      v="$(extract_version "$out")"
      if [ -n "${v:-}" ]; then
        echo "$pkg|$v|dpkg"
        return 0
      fi
    done
  fi

  if have_cmd rpm; then
    for pkg in google-chrome-stable chromium; do
      out="$(rpm -q --qf '%{VERSION}\n' "$pkg" 2>/dev/null || true)"
      v="$(extract_version "$out")"
      if [ -n "${v:-}" ]; then
        echo "$pkg|$v|rpm"
        return 0
      fi
    done
  fi

  return 1
}

result="$(get_browser_version || true)"

if [ -z "$result" ]; then
  echo "UNKNOWN - Chrome/Chromium not found or version could not be determined"
  exit 2
fi

name="$(echo "$result" | cut -d'|' -f1)"
version="$(echo "$result" | cut -d'|' -f2)"
source_type="$(echo "$result" | cut -d'|' -f3)"

if version_ge "$version" "$FIXED_VERSION"; then
  echo "PATCHED - $name version $version detected via $source_type (fixed: $FIXED_VERSION)"
  exit 0
else
  echo "VULNERABLE - $name version $version detected via $source_type (fixed: $FIXED_VERSION)"
  exit 1
fi

Sources

1. NVD record for CVE-2026-11000
2. Chrome Stable Channel Update for Desktop, June 2 2026
3. Chromium issue 492374380
4. CISA Known Exploited Vulnerabilities Catalog
5. FIRST EPSS data and statistics
6. FIRST EPSS API documentation
7. Chromium Linux sandbox README
8. Chromium process sandboxes by platform