Use after free in Codecs in Google Chrome on Windows prior to 149

CVE-2026-11094 is a CWE-416 use-after-free in Chrome's Codecs component affecting Google Chrome on Windows before 149.0.7827.53. The important real-world detail is the attack position implied by the title you supplied: this is not the initial browser compromise, but a post-renderer-compromise bug that helps an attacker who already landed code in the renderer try to move farther toward a sandbox escape or stronger host impact.

Google's own June 2, 2026 Chrome 149 advisory classifies CVE-2026-11094 as Medium, not Critical, and that matches reality better than the prompt's 9.6 label. Requiring a compromised renderer is massive friction: it means the attacker already needs a separate bug or chain stage first, blast radius is one endpoint at a time, there is no KEV listing, and the supplied EPSS 0.00035 is basically background noise rather than an active-crime signal.

Why this verdict

• Major downward adjustment: requires prior renderer compromise — that means the attacker already completed the hard part of the browser attack chain before this CVE matters.
• No exploitation signal — not KEV-listed, no Google zero-day statement, and supplied EPSS 0.00035 is nowhere near emergency territory.
• Client-side, per-endpoint blast radius — this is a workstation/browser problem, not an internet-facing service flaw that can be sprayed across the fleet in one sweep.

Why not higher?

If this were a one-click remote browser-to-host escape with active exploitation, the verdict would move up fast. But the prerequisite chain is too restrictive: user interaction plus a separate renderer compromise plus a reliable second-stage exploit is not how broad opportunistic abuse usually scales.

Why not lower?

This is still a browser memory-corruption bug in Chrome on Windows, which is a very large exposure population in enterprise fleets. If an attacker already has a renderer foothold, a sandbox-adjacent codec bug can be high-value for targeted follow-on intrusion, so it does not belong in backlog-ignore territory.

1. Enforce auto-update — Make sure Chrome stable auto-update is not being deferred or broken by policy, and confirm Windows endpoints are converging on 149.0.7827.53+. For a MEDIUM verdict there is no noisgate mitigation SLA; use this as normal hardening while you work inside the remediation window.
2. Use browser isolation for risky users — Keep high-risk roles such as admins, finance, executives, and research staff in remote/browser isolation where feasible. This does not remove the bug, but it cuts the value of renderer-to-host chains while you remediate inside the 365-day window.
3. Hunt for Chrome crash anomalies — Pull Windows Error Reporting, EDR, and Chrome crash telemetry for sudden spikes in chrome.exe or media/utility-process crashes after suspicious browsing events. There is no mitigation SLA for MEDIUM, so use this as a detection backstop rather than an emergency compensating action.
4. Reduce local admin and privileged browsing — Keep daily browsing out of privileged sessions and remove unnecessary local admin rights so a successful browser chain has less room to cash out. This matters even when the bug is only a chain component.

Run this on the target Windows endpoint or via your remote management tool. Example: powershell.exe -ExecutionPolicy Bypass -File .\check-chrome-cve-2026-11094.ps1; standard user rights are usually enough because it reads file/registry version data, but local admin helps when inventory paths are locked down.

# check-chrome-cve-2026-11094.ps1
# Purpose: Determine whether Google Chrome on Windows is vulnerable to CVE-2026-11094
# Logic: Versions lower than 149.0.7827.53 are VULNERABLE
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

$ErrorActionPreference = 'Stop'

function Get-VersionObject {
    param([string]$Version)
    try {
        return [version]$Version
    } catch {
        return $null
    }
}

function Get-ChromeVersion {
    $candidates = @(
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
        'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe'
    )

    foreach ($path in $candidates) {
        try {
            $item = Get-ItemProperty -Path $path -ErrorAction Stop
            if ($item.'(default)' -and (Test-Path $item.'(default)')) {
                $ver = (Get-Item $item.'(default)').VersionInfo.ProductVersion
                if ($ver) { return $ver }
            }
            if ($item.Path) {
                $exe = Join-Path $item.Path 'chrome.exe'
                if (Test-Path $exe) {
                    $ver = (Get-Item $exe).VersionInfo.ProductVersion
                    if ($ver) { return $ver }
                }
            }
        } catch {}
    }

    $fileCandidates = @(
        "$env:ProgramFiles\Google\Chrome\Application\chrome.exe",
        "$env:ProgramFiles(x86)\Google\Chrome\Application\chrome.exe",
        "$env:LocalAppData\Google\Chrome\Application\chrome.exe"
    )

    foreach ($exe in $fileCandidates) {
        try {
            if (Test-Path $exe) {
                $ver = (Get-Item $exe).VersionInfo.ProductVersion
                if ($ver) { return $ver }
            }
        } catch {}
    }

    return $null
}

$fixed = Get-VersionObject '149.0.7827.53'
$current = Get-ChromeVersion

if (-not $current) {
    Write-Output 'UNKNOWN - Google Chrome not found or version could not be determined.'
    exit 2
}

$currentVersion = Get-VersionObject $current
if (-not $currentVersion) {
    Write-Output "UNKNOWN - Installed Chrome version '$current' could not be parsed."
    exit 2
}

if ($currentVersion -lt $fixed) {
    Write-Output "VULNERABLE - Installed Chrome version $current is older than 149.0.7827.53."
    exit 1
} else {
    Write-Output "PATCHED - Installed Chrome version $current is 149.0.7827.53 or newer."
    exit 0
}

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop (Chrome 149)
2. Google Chrome Releases index for 2026
3. Chromium Security overview
4. CISA Known Exploited Vulnerabilities Catalog
5. FIRST EPSS overview
6. FIRST EPSS API documentation
7. MITRE CWE-416: Use After Free
8. Chromium issue tracker reference for CVE-2026-11094