Use after free in WebRTC in Google Chrome on Linux prior to 149

This is a WebRTC *use-after-free* in Google Chrome on Linux affecting builds before 149.0.7827.53, disclosed on 2026-06-04. The attacker path is classic browser exploitation: get a user onto a crafted page, trigger memory corruption in the renderer-side processing path, and aim for code execution. Public mirrors and the user-supplied intel map this to CVE-2026-11074; Google’s June 2, 2026 stable release advisory confirms 149.0.7827.53 as the Linux fix line for this disclosure batch.

Google’s 8.8/HIGH baseline is technically fair for a remotely triggerable browser memory bug, but it overstates enterprise urgency if you are triaging a 10,000-host patch queue. The real-world drag is substantial: *user interaction is required, the target population is Linux Chrome only, there is no KEV listing or active exploitation evidence, EPSS is very low, and modern Chromium sandboxing/site isolation materially reduces immediate blast radius unless the attacker also has a second escape or privilege-escalation bug.*

Why this verdict

• User interaction drags this down: the attacker must get a user onto crafted content, which implies phishing, malvertising, or site compromise rather than direct blind exploitation.
• Linux-only narrows the reachable population: in most enterprises, Linux Chrome is a much smaller fleet than Windows browsers, so the exposed population is materially lower than the vendor base score assumes.
• The likely first win is renderer compromise, not host takeover: Chromium’s sandbox and site isolation are built to contain compromised renderer processes, so the attacker usually needs a second-stage escape or data-theft objective to turn this into a full endpoint incident.
• Threat intel is cold: no KEV listing, no public exploitation evidence, and a very low EPSS (0.00071) are all downward pressure against the vendor 8.8 baseline.
• Still not low: it is remotely reachable through normal browsing, requires no auth, and memory-corruption bugs in browsers remain high-value to capable actors.

Why not higher?

There is no evidence in the reviewed sources that this CVE is being exploited in the wild, and there is no KEV pressure. More importantly, the path appears to stop at sandboxed renderer execution in the first stage, which is a real but contained foothold rather than immediate unconstrained OS-level RCE.

Why not lower?

This is still a browser memory-safety flaw reachable from web content with no privileges required. Even with user interaction and sandboxing, browsers are high-frequency exposure points, and a capable attacker can combine a renderer bug with credential theft, browser data access, or a second-stage escape.

1. Force browser updates — Push managed Chrome updates or package updates to Linux endpoints and verify the fleet converges on 149.0.7827.53 or distro-equivalent patched builds. For a MEDIUM noisgate verdict there is *no mitigation SLA*; go straight to the remediation window and complete patching within 365 days, but in practice browsers should ride the next normal endpoint patch wave.
2. Reduce risky browsing paths — Prioritize web filtering, Safe Browsing enforcement, and email-link detonation for Linux user groups that browse untrusted content. This lowers the chance the required UI:R step ever lands; deploy as part of normal control hygiene while patching within the 365-day remediation window.
3. Harden Chrome policy — Use enterprise policy to restrict unnecessary features and extensions, keep Site Isolation defaults intact, and prevent users from weakening browser security settings. This does not remove the bug, but it preserves the controls that make the first-stage blast radius smaller while you remediate within the 365-day window.
4. Watch renderer-to-host pivots — Tune EDR detections for suspicious child processes from chrome, abnormal extension installs, credential-store access, and unusual crash bursts. That gives you a shot at catching failed or partially successful exploit chains while patched rollout proceeds under the MEDIUM remediation window.

Run this on the Linux target host or through your Linux endpoint management agent. Invoke it as bash check_chrome_cve_2026_11074.sh with standard user rights; root is *not* required unless your fleet stores Chrome binaries in nonstandard protected paths.

#!/usr/bin/env bash
# check_chrome_cve_2026_11074.sh
# Detects whether Google Chrome on Linux is vulnerable to CVE-2026-11074
# Logic: versions prior to 149.0.7827.53 are VULNERABLE
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

FIXED_VERSION="149.0.7827.53"

find_chrome() {
  local candidates=(
    "google-chrome"
    "google-chrome-stable"
    "/usr/bin/google-chrome"
    "/usr/bin/google-chrome-stable"
    "/opt/google/chrome/chrome"
    "/snap/bin/chromium"
    "chromium"
    "chromium-browser"
  )

  local c
  for c in "${candidates[@]}"; do
    if command -v "$c" >/dev/null 2>&1; then
      command -v "$c"
      return 0
    elif [ -x "$c" ]; then
      echo "$c"
      return 0
    fi
  done
  return 1
}

extract_version() {
  local bin="$1"
  local out
  out="$($bin --version 2>/dev/null || true)"
  echo "$out" | grep -Eo '[0-9]+(\.[0-9]+){3}' | head -n1
}

vercmp() {
  # returns: 0 equal, 1 greater, 2 less
  local a="$1" b="$2"
  if [ "$a" = "$b" ]; then
    return 0
  fi
  local first
  first=$(printf '%s\n%s\n' "$a" "$b" | sort -V | head -n1)
  if [ "$first" = "$a" ]; then
    return 2
  else
    return 1
  fi
}

BIN="$(find_chrome || true)"
if [ -z "$BIN" ]; then
  echo "UNKNOWN: Chrome/Chromium binary not found"
  exit 2
fi

VERSION="$(extract_version "$BIN")"
if [ -z "$VERSION" ]; then
  echo "UNKNOWN: Unable to determine browser version from $BIN"
  exit 2
fi

# This CVE is described for Google Chrome on Linux. Chromium may carry equivalent fixes via distro backports.
# If we find Chromium, version-only comparison may be insufficient; flag UNKNOWN unless version clearly meets/exceeds upstream fix.
BASENAME="$(basename "$BIN")"

vercmp "$VERSION" "$FIXED_VERSION"
CMP=$?

if [ "$CMP" -eq 2 ]; then
  if [[ "$BASENAME" == chromium* ]]; then
    echo "UNKNOWN: Chromium version $VERSION is below upstream Chrome fix $FIXED_VERSION; verify distro backport status"
    exit 2
  fi
  echo "VULNERABLE: $BIN version $VERSION is older than fixed version $FIXED_VERSION"
  exit 1
elif [ "$CMP" -eq 0 ] || [ "$CMP" -eq 1 ]; then
  echo "PATCHED: $BIN version $VERSION is at or above fixed version $FIXED_VERSION"
  exit 0
else
  echo "UNKNOWN: Version comparison failed"
  exit 2
fi

Sources

1. Google Chrome Releases: Stable Channel Update for Desktop (June 2, 2026)
2. Canadian Centre for Cyber Security AV26-544
3. NVD detail for closely related June 2026 Chrome WebRTC UAF (`CVE-2026-10939`)
4. Chromium Site Isolation design document
5. Chromium Secure Architecture overview
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS overview / methodology
8. Quanteta CVE tracker entry showing public mirroring of `CVE-2026-11074` metadata