Use after free in Media in Google Chrome on Linux and ChromeOS prior to 149

CVE-2026-11028 is a use-after-free in Chrome Media affecting Google Chrome on Linux and ChromeOS before 149.0.7827.53. The key phrase in the description matters more than the generic CVSS: the attacker must have already compromised the renderer process and then use a crafted page or media path to turn that foothold into a sandbox escape on the affected platforms.

paragraphs_vendor_note_placeholder

Why this verdict

• Start from vendor 8.8, then cut hard for prerequisite: this is not internet-to-host by itself; the attacker must already have renderer code execution.
• Platform narrowing matters: affected scope is Linux and ChromeOS, not the full desktop Chrome estate, so exposed population is materially smaller.
• No heat around it: no KEV, no public PoC found, and the supplied EPSS 0.0008 is extremely low.
• Modern controls should break the chain earlier: browser isolation, crash telemetry, EDR, and rapid auto-update are more likely to stop or surface the preceding renderer exploit than an edge service would be.

Why not higher?

Because the vulnerability assumes a prior compromise stage, it is compounding rather than initiating attacker success. In enterprise terms, this is a chain amplifier for already-sophisticated browser exploitation, not a mass-reachable remote entry point.

Why not lower?

A working sandbox escape in Chrome still has serious endpoint impact, especially on Linux admin workstations and sensitive ChromeOS roles. If an attacker already has renderer execution, this bug can meaningfully raise privileges and break containment, so it is not mere hygiene.

1. Keep Linux and ChromeOS on rapid browser auto-update — For a MEDIUM verdict there is no mitigation SLA; keep this in the normal browser-update ring and complete vendor remediation within the 365-day window. Auto-update matters more here than bespoke blocking because exploitability is tightly coupled to exact build versions.
2. Harden risky browsing tiers — Apply stricter browsing isolation or separate profiles for privileged Linux users, kiosks, and internet-facing research roles. There is no mitigation SLA — go straight to remediation planning, but reducing hostile-content exposure lowers the odds that a first-stage renderer exploit ever lands.
3. Watch for renderer crash bursts — Use EDR, browser crash telemetry, and SOC correlation to flag repeated Chrome child-process crashes and sandbox anomalies on Linux/ChromeOS. This does not replace patching, but it is the most practical way to spot exploit-chain activity while you remediate inside the 365-day window.

Run this on the target Linux or ChromeOS endpoint locally, or via your fleet agent/SSH. Invoke it as bash check_chrome_cve_2026_11028.sh; no root is required, but the script needs permission to execute the installed Chrome binary if it lives under a restricted path.

#!/usr/bin/env bash
# check_chrome_cve_2026_11028.sh
# Detects whether local Google Chrome / Chromium build is older than 149.0.7827.53
# Outputs one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

FIXED_VERSION="149.0.7827.53"
FOUND_VERSION=""
FOUND_BIN=""

CANDIDATES=(
  "google-chrome"
  "google-chrome-stable"
  "chromium"
  "chromium-browser"
  "/opt/google/chrome/chrome"
  "/usr/bin/google-chrome"
  "/usr/bin/google-chrome-stable"
  "/usr/bin/chromium"
  "/usr/bin/chromium-browser"
)

get_version() {
  local bin="$1"
  local raw
  raw="$($bin --product-version 2>/dev/null || $bin --version 2>/dev/null)" || return 1
  echo "$raw" | grep -Eo '[0-9]+(\.[0-9]+){3}' | head -n1
}

ver_lt() {
  # returns 0 if $1 < $2
  [ "$1" = "$2" ] && return 1
  local first
  first=$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)
  [ "$first" = "$1" ]
}

for bin in "${CANDIDATES[@]}"; do
  if command -v "$bin" >/dev/null 2>&1; then
    ver=$(get_version "$bin")
    if [ -n "$ver" ]; then
      FOUND_VERSION="$ver"
      FOUND_BIN="$bin"
      break
    fi
  elif [ -x "$bin" ]; then
    ver=$(get_version "$bin")
    if [ -n "$ver" ]; then
      FOUND_VERSION="$ver"
      FOUND_BIN="$bin"
      break
    fi
  fi
done

if [ -z "$FOUND_VERSION" ]; then
  echo "UNKNOWN - could not determine Chrome/Chromium version from common paths"
  exit 2
fi

if ver_lt "$FOUND_VERSION" "$FIXED_VERSION"; then
  echo "VULNERABLE - $FOUND_BIN version $FOUND_VERSION is older than fixed $FIXED_VERSION"
  exit 1
else
  echo "PATCHED - $FOUND_BIN version $FOUND_VERSION is at or newer than fixed $FIXED_VERSION"
  exit 0
fi

Sources

1. Chrome Releases - Early Stable Update for Desktop (149.0.7827.53/.54)
2. Canadian Centre for Cyber Security - Google Chrome security advisory AV26-544
3. CISA Known Exploited Vulnerabilities Catalog
4. FIRST EPSS project
5. MITRE CWE-416 Use After Free
6. CVE.org record for analogous Chrome renderer-compromise-to-sandbox-escape pattern (CVE-2026-5288)
7. NVD detail for analogous Chrome sandbox-escape phrasing (CVE-2026-8001)
8. NVD detail for analogous Media-on-Linux/ChromeOS renderer-compromised bug (CVE-2026-8535)