Use after free in ANGLE in Google Chrome on Windows prior to 149

CVE-2026-11055 is a use-after-free in Chrome's ANGLE graphics layer on Windows that affects versions prior to 149.0.7827.53. A malicious site can trigger memory corruption through normal browser content and potentially execute attacker-controlled code, but the execution context described for this CVE is inside a sandboxed Chrome process, not the full host.

The user's starting baseline of HIGH 8.8 overstates the operational risk for enterprise patch triage. In real deployments this is gated by user interaction, Windows-only scope, and most importantly sandbox confinement; without a second vulnerability or a local escape, this is usually a dead-end for full-host compromise, which is why Chrome's own release notes list this bug as Medium rather than a top-tier browser emergency.

Why this verdict

• Sandboxed-only impact cuts the score down hard: the CVE text itself says code execution occurs *inside a sandbox*, which is materially different from browser-process or host-level code execution.
• User interaction is a real gate: the attacker needs a user to render malicious web content, so this is a drive-by risk, not an unauthenticated no-click server compromise.
• Windows-only narrows the population: Mac, Linux, iOS, Android, and ChromeOS hosts are out-of-scope for this specific CVE, which matters when you are triaging a mixed 10,000-host estate.
• Threat intel is quiet: no KEV entry, no public exploitation evidence in the reviewed sources, and a very low user-supplied EPSS all push downward from the abstract 8.8 baseline.

Why not higher?

It is not HIGH or CRITICAL in patch-priority terms because there is no sourced evidence here of sandbox escape, active exploitation, or a bundled exploit chain. A browser memory bug is serious, but a sandboxed foothold without a proven second-stage escape is not the same as immediate host compromise.

Why not lower?

It is not LOW or IGNORE because the trigger is still reachable by an unauthenticated remote attacker through ordinary web content, and Chrome is ubiquitous in enterprise fleets. Even sandboxed code execution can be useful for credential theft, browser-session abuse, or chaining with another weakness.

1. Force Chrome auto-update on Windows — Make sure enterprise policy is not deferring stable browser updates longer than necessary. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but browser auto-update should be treated as baseline hygiene so vulnerable builds age out quickly.
2. Hunt for abnormal Chrome child-process behavior — Tune EDR detections for chrome.exe spawning LOLBins, script hosts, installers, or other unusual descendants. This is the most practical compensating control while waiting for patch compliance because the second-stage pivot is usually louder than the initial memory corruption; for MEDIUM, there is no mitigation SLA — use this as hygiene control until patch completion.
3. Reduce risky browsing exposure for high-value users — Apply stricter web filtering, remote browser isolation, or hardened browsing groups for admins, finance, and executives who face the most realistic watering-hole risk. This does not replace patching, but it lowers the chance that a crafted page ever reaches the vulnerable browser during the remediation window.

Run this on the target Windows host or through your endpoint management tool. Example: powershell -ExecutionPolicy Bypass -File .\check-chrome-cve-2026-11055.ps1 or powershell -ExecutionPolicy Bypass -File .\check-chrome-cve-2026-11055.ps1 -MinVersion 149.0.7827.53. Standard user rights are usually enough because the script reads registry and file version data only.

param(
    [string]$MinVersion = "149.0.7827.53"
)

# check-chrome-cve-2026-11055.ps1
# Purpose: Detect whether Google Chrome on Windows is below the fixed version for CVE-2026-11055.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

function Get-ChromeVersionFromExe {
    param([string]$Path)
    try {
        if (Test-Path $Path) {
            $item = Get-Item $Path -ErrorAction Stop
            if ($item.VersionInfo -and $item.VersionInfo.ProductVersion) {
                return $item.VersionInfo.ProductVersion
            }
        }
    } catch {}
    return $null
}

function Get-ChromeVersionFromRegistry {
    $paths = @(
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
        'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe'
    )

    foreach ($p in $paths) {
        try {
            $reg = Get-ItemProperty -Path $p -ErrorAction Stop
            if ($reg.'(default)') {
                $v = Get-ChromeVersionFromExe -Path $reg.'(default)'
                if ($v) { return $v }
            }
            if ($reg.Path) {
                $candidate = Join-Path $reg.Path 'chrome.exe'
                $v = Get-ChromeVersionFromExe -Path $candidate
                if ($v) { return $v }
            }
        } catch {}
    }
    return $null
}

function Normalize-Version {
    param([string]$VersionString)
    try {
        return [version]$VersionString
    } catch {
        return $null
    }
}

$candidatePaths = @(
    "$env:ProgramFiles\Google\Chrome\Application\chrome.exe",
    "$env:ProgramFiles(x86)\Google\Chrome\Application\chrome.exe",
    "$env:LocalAppData\Google\Chrome\Application\chrome.exe"
)

$foundVersions = @()

foreach ($path in $candidatePaths) {
    $v = Get-ChromeVersionFromExe -Path $path
    if ($v) { $foundVersions += $v }
}

$regVersion = Get-ChromeVersionFromRegistry
if ($regVersion) { $foundVersions += $regVersion }

$foundVersions = $foundVersions | Sort-Object -Unique

if (-not $foundVersions -or $foundVersions.Count -eq 0) {
    Write-Output "UNKNOWN: Google Chrome not found or version unreadable"
    exit 2
}

$min = Normalize-Version -VersionString $MinVersion
if (-not $min) {
    Write-Output "UNKNOWN: Invalid minimum version supplied: $MinVersion"
    exit 2
}

$parsed = @()
foreach ($fv in $foundVersions) {
    $pv = Normalize-Version -VersionString $fv
    if ($pv) {
        $parsed += [pscustomobject]@{ Raw = $fv; Parsed = $pv }
    }
}

if (-not $parsed -or $parsed.Count -eq 0) {
    Write-Output "UNKNOWN: Found Chrome but could not parse any version values"
    exit 2
}

# If any discovered Chrome install is below the fixed version, flag host as vulnerable.
$vuln = $parsed | Where-Object { $_.Parsed -lt $min }

if ($vuln) {
    $versions = ($parsed.Raw -join ', ')
    Write-Output "VULNERABLE: Detected Chrome version(s): $versions ; fixed version is $MinVersion or later"
    exit 1
} else {
    $versions = ($parsed.Raw -join ', ')
    Write-Output "PATCHED: Detected Chrome version(s): $versions ; all meet or exceed $MinVersion"
    exit 0
}

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop (June 2, 2026)
2. Chromium issue 498881735
3. Chromium Security - Severity Guidelines for Security Issues
4. Chromium Security
5. Chrome sandbox diagnostics for Windows
6. Chromium Memory Safety
7. CISA Known Exploited Vulnerabilities Catalog
8. FIRST EPSS API documentation