Use after free in Updater in Google Chrome on Windows prior to 149

CVE-2026-11115 is a use-after-free in the Chrome Updater on Windows that affects Chrome builds before 149.0.7827.53. The bug lives in the privileged update plumbing rather than the browser renderer, so the practical outcome is local privilege escalation to OS-level privileges when a low-privilege attacker can get the updater to process a malicious file on a vulnerable Windows host.

The supplied 7.3/HIGH baseline overshoots reality for enterprise prioritization. This is post-initial-access by definition: the attacker already needs a foothold on the endpoint, low-privileged code execution, and a path to feed the updater crafted input; there is no internet exposure, no KEV entry, very low EPSS, and I found no public PoC as of 2026-06-05. That keeps it important for hardening and cleanup of lagging Windows fleets, but not in the same league as remotely reachable Chrome bugs.

Why this verdict

• Downgrade for attacker position: AV:L + PR:L + UI:R means the attacker already has a foothold on the host and a user-mediated file path; this is not initial access and not internet-reachable
• Further downgrade for reachable population: only Windows systems with a vulnerable Chrome Updater are in scope, so exposure is a subset of already-compromised endpoints rather than your whole browser estate
• Some score preserved for blast radius: if it lands, it can escalate to OS-level privileges, which materially improves persistence, credential theft, and defense evasion on that host
• No urgency amplifier present: not in KEV, no public exploit found, and EPSS 0.00008 all argue against treating this like an active browser zero-day
• Modern controls should break the chain early: EDR, application control, user-write restrictions, and browser auto-update all reduce the practical success rate before the updater bug matters

Why not higher?

If this were unauthenticated remote, actively exploited, or trivially weaponized with a public PoC, the score would climb fast because Chrome is everywhere. But the chain here begins with local attacker access and a malicious file, which compounds the friction and keeps the exposed population narrow.

Why not lower?

I am not pushing this to LOW because a working local privilege escalation to SYSTEM on a ubiquitous enterprise endpoint is still meaningful. Attackers do chain low-privilege footholds into LPE routinely, and Chrome’s updater runs in a privileged trust boundary that can turn a noisy compromise into a durable one.

1. Harden application control — Enforce WDAC/AppLocker/Defender Application Control so untrusted binaries and scripts from user-writable locations cannot stage the local foothold or final payload. For a MEDIUM verdict there is no mitigation SLA; deploy in the normal hardening cycle if you are not already doing it.
2. Constrain user-writable execution paths — Block or heavily monitor execution from %TEMP%, %APPDATA%, downloads, and other user-controlled paths. This cuts the most common path to prerequisite local code execution and makes file-based LPE chains less reliable.
3. Monitor updater abuse — Create detections for abnormal launches of Chrome/Google updater binaries, especially unexpected child processes, temp-path ancestry, or SYSTEM processes spawned from updater activity. This is the best compensating visibility when you cannot patch every straggler immediately.
4. Reduce standing local admin and repair drift — Even though the CVE only needs low privilege, cleaning up excess rights, stale software deployment patterns, and unmanaged user installs reduces the chance of exploitable updater configurations hanging around until the 365-day remediation window closes.

Run this on the target Windows endpoint or through your EDR/live-response shell. Invoke it as powershell.exe -ExecutionPolicy Bypass -File .\check-chrome-cve-2026-11115.ps1; standard user rights are usually enough to read file versions, but admin helps if you want complete coverage of machine-wide install paths.

# check-chrome-cve-2026-11115.ps1

# Detects whether Google Chrome on Windows is older than 149.0.7827.53

# Output: VULNERABLE / PATCHED / UNKNOWN

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


$ErrorActionPreference = 'SilentlyContinue'

function Get-VersionObject {
    param([string]$VersionString)
    try { return [version]$VersionString } catch { return $null }
}

$fixed = Get-VersionObject '149.0.7827.53'
$paths = @(
    "$env:ProgramFiles\Google\Chrome\Application\chrome.exe",
    "$env:ProgramFiles(x86)\Google\Chrome\Application\chrome.exe",
    "$env:LocalAppData\Google\Chrome\Application\chrome.exe"
) | Select-Object -Unique

$found = @()

foreach ($p in $paths) {
    if (Test-Path $p) {
        $ver = (Get-Item $p).VersionInfo.ProductVersion
        if (-not $ver) { $ver = (Get-Item $p).VersionInfo.FileVersion }
        if ($ver) {
            $found += [pscustomobject]@{ Path = $p; Version = $ver }
        }
    }
}

# Registry fallbacks

$regPaths = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe'
)

foreach ($rp in $regPaths) {
    $reg = Get-ItemProperty -Path $rp
    if ($reg -and $reg.'(default)') {
        $p = $reg.'(default)'
        if ((Test-Path $p) -and -not ($found.Path -contains $p)) {
            $ver = (Get-Item $p).VersionInfo.ProductVersion
            if (-not $ver) { $ver = (Get-Item $p).VersionInfo.FileVersion }
            if ($ver) {
                $found += [pscustomobject]@{ Path = $p; Version = $ver }
            }
        }
    }
}

if (-not $found -or $found.Count -eq 0) {
    Write-Output 'UNKNOWN - Google Chrome executable not found in common locations'
    exit 2
}

$vulnerable = $false
$unknown = $false

foreach ($item in $found) {
    $v = Get-VersionObject $item.Version
    if ($null -eq $v) {
        Write-Output ("UNKNOWN - Could not parse version '{0}' at {1}" -f $item.Version, $item.Path)
        $unknown = $true
        continue
    }

    if ($v -lt $fixed) {
        Write-Output ("VULNERABLE - {0} at {1}" -f $item.Version, $item.Path)
        $vulnerable = $true
    }
    else {
        Write-Output ("PATCHED - {0} at {1}" -f $item.Version, $item.Path)
    }
}

if ($vulnerable) { exit 1 }
if ($unknown) { exit 2 }
exit 0

Sources

1. Chrome Releases: Stable Channel Update for Desktop (Chrome 149)
2. Chromium issue 501370283
3. CVE Record: CVE-2026-11115
4. Vulnerability-Lookup entry for CVE-2026-11115
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS data and statistics
7. Chromium Updater Functional Specification
8. Canadian Centre for Cyber Security Chrome 149 advisory