Use after free in WebSockets in Google Chrome prior to 149

CVE-2026-11068 is a CWE-416 use-after-free in Chrome's WebSockets handling. A malicious site can trigger memory corruption through crafted HTML/JavaScript and gain code execution inside Chrome's sandboxed renderer context, affecting Google Chrome versions before 149.0.7827.53 on Linux and before 149.0.7827.53/54 on Windows and macOS.

The vendor-style 8.8 HIGH CVSS is too hot for enterprise patch triage because it prices in full C:H/I:H/A:H impact, while Chromium's own security label is Medium and the NVD description explicitly says execution is *inside a sandbox*. In real fleets, that means this bug is dangerous as a chain component or phishing payload, but by itself it is usually not endpoint takeover.

Why this verdict

• Sandboxed code exec cuts the score down: the NVD text says arbitrary code execution is *inside a sandbox*, and Chromium itself tags the bug Medium; that is materially less dangerous than workstation-level RCE.
• UI:R is real friction: attackers need a browsing event to hostile content. That still scales via phishing and malvertising, but it is weaker than unauthenticated server-side exploitation and weaker than UI:N browser chains.
• No exploitation signal: EPSS 0.00071, no KEV listing, and no public PoC found. With no evidence of operational attacker demand, this belongs in disciplined browser patching rather than emergency handling.

Why not higher?

There is no evidence this CVE alone breaks out of Chrome's sandbox, and that matters more than the raw CVSS math. No KEV entry, no active exploitation reporting, and no public exploit kit all argue against a HIGH or CRITICAL enterprise priority.

Why not lower?

This is still a memory-corruption bug in one of the most broadly deployed user applications in the enterprise. PR:N, AC:L, and browser-based delivery keep it above LOW even though the sandbox prevents us from treating it like direct endpoint compromise.

1. Force Chrome auto-update and relaunch compliance — Use enterprise browser management to ensure endpoints actually move to 149.0.7827.53+ and relaunch, because stale browsers are the only meaningful exposure lever here. For a MEDIUM verdict there is no mitigation SLA; go straight to durable remediation inside the 365-day window, but do not let unmanaged update lag linger in high-risk user groups.
2. Identify and remove unmanaged browser installs — Hunt for portable Chromium/Chrome binaries, developer-side alternate channels, and non-managed local installs that bypass your normal update ring. This is how browser risk quietly persists after central patch dashboards say you're green; again, MEDIUM means no separate mitigation clock, but cleanup should happen as part of the remediation program.
3. Apply browser isolation to high-risk populations — Remote browser isolation or disposable browsing for finance, exec, help-desk, and threat-intel users reduces the chance that a renderer exploit touches a real workstation at all. Treat this as targeted risk reduction while normal remediation rolls out; there is no noisgate mitigation deadline for MEDIUM, but it is worth enabling where exposure is concentrated.
4. Keep EDR browser exploit protections enabled — Memory-protection, child-process, and browser-hardening controls are most valuable at the post-exploit step where the attacker tries to convert renderer execution into host impact. They do not replace patching, but they are the main controls that meaningfully interfere with the highest-value follow-on stage.

Run this on the target endpoint or via your software distribution/EDR script runner. Invoke with python3 check_chrome_cve_2026_11068.py on macOS/Linux or py check_chrome_cve_2026_11068.py on Windows; standard user rights are usually enough because the script only reads version info from common install paths and the registry.

#!/usr/bin/env python3
# Check Google Chrome version exposure for CVE-2026-11068
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import os
import platform
import re
import subprocess
import sys

FIXED = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_to_str(v):
    return '.'.join(str(x) for x in v)


def is_patched(v):
    return v >= FIXED


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        if p.returncode == 0:
            return p.stdout.strip() or p.stderr.strip()
    except Exception:
        pass
    return None


def check_windows():
    installs = []
    reg_queries = [
        ["reg", "query", r"HKLM\SOFTWARE\Google\Chrome\BLBeacon", "/v", "version"],
        ["reg", "query", r"HKLM\SOFTWARE\WOW6432Node\Google\Chrome\BLBeacon", "/v", "version"],
        ["reg", "query", r"HKCU\SOFTWARE\Google\Chrome\BLBeacon", "/v", "version"],
    ]
    for q in reg_queries:
        out = run_cmd(q)
        if out:
            v = parse_version(out)
            if v:
                installs.append(("registry", v))

    paths = [
        os.path.expandvars(r"%ProgramFiles%\Google\Chrome\Application\chrome.exe"),
        os.path.expandvars(r"%ProgramFiles(x86)%\Google\Chrome\Application\chrome.exe"),
        os.path.expandvars(r"%LocalAppData%\Google\Chrome\Application\chrome.exe"),
    ]
    for path in paths:
        if path and os.path.exists(path):
            out = run_cmd([path, "--version"])
            if out:
                v = parse_version(out)
                if v:
                    installs.append((path, v))
    return installs


def check_macos():
    installs = []
    paths = [
        "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
        os.path.expanduser("~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"),
    ]
    for path in paths:
        if os.path.exists(path):
            out = run_cmd([path, "--version"])
            if out:
                v = parse_version(out)
                if v:
                    installs.append((path, v))
    return installs


def check_linux():
    installs = []
    cmds = [
        ["google-chrome", "--version"],
        ["google-chrome-stable", "--version"],
        ["chromium", "--version"],
        ["chromium-browser", "--version"],
    ]
    for cmd in cmds:
        out = run_cmd(cmd)
        if out:
            v = parse_version(out)
            if v:
                installs.append((' '.join(cmd), v))
    return installs


def main():
    system = platform.system().lower()
    if 'windows' in system:
        installs = check_windows()
    elif 'darwin' in system:
        installs = check_macos()
    else:
        installs = check_linux()

    if not installs:
        print("UNKNOWN - No Chrome/Chromium installation found in common locations")
        sys.exit(2)

    vulnerable = []
    patched = []
    for source, ver in installs:
        if is_patched(ver):
            patched.append((source, ver))
        else:
            vulnerable.append((source, ver))

    if vulnerable:
        details = '; '.join([f"{src}: {version_to_str(ver)}" for src, ver in vulnerable])
        print(f"VULNERABLE - Found version(s) below {version_to_str(FIXED)} :: {details}")
        sys.exit(1)

    details = '; '.join([f"{src}: {version_to_str(ver)}" for src, ver in patched])
    print(f"PATCHED - All discovered version(s) are >= {version_to_str(FIXED)} :: {details}")
    sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. NVD CVE-2026-11068
2. Chrome Releases: Stable Channel Update for Desktop (June 2, 2026)
3. Chrome Releases 2026 archive entry showing CVE-2026-11068 attribution
4. Chromium fix commit for issue 499194333
5. Canadian Centre for Cyber Security advisory AV26-544
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS documentation