Use after free in Views in Google Chrome on Windows prior to 149

CVE-2026-11117 is a Windows-only use-after-free in Chrome's Views UI layer. Affected builds are Google Chrome on Windows before 149.0.7827.53; Google released Chrome 149 stable on 2026-06-02, and the CVE was published on 2026-06-04. The bug can be triggered by a crafted HTML page and the CVE text says it may allow arbitrary code execution.

The vendor CVSS 8.8/HIGH is technically defensible in a vacuum, but it overstates operational urgency for enterprise patch triage. The attack still requires a user to be lured into rendering attacker content in Chrome, there is no KEV listing, the CVE record's SSVC says Exploitation: none / Automatable: no, EPSS is extremely low, and Chromium itself labeled the underlying bug Medium. For a team juggling 10,000 endpoints, this is real but it is not the fire that pre-auth edge RCEs are.

Why this verdict

• Down from vendor 8.8 because UI:R matters: the attacker must win a phishing/malvertising/web-lure step before the bug is even reachable.
• Windows-only scope narrows population: this is not a cross-platform Chrome emergency; mixed-platform fleets have a smaller exposed subset.
• No active exploitation evidence: not in KEV, SSVC says Exploitation: none, and the user-provided EPSS is extremely low.
• Chromium called it Medium internally: when the CNA that knows the code best labels the underlying bug medium, I treat that as meaningful downward pressure unless external exploitation says otherwise.
• Endpoint blast radius is controllable: EDR, application control, and least privilege materially limit what a browser foothold can do compared with exposed server software.

Why not higher?

If this were KEV-listed, paired with a public exploit chain, or clearly documented as reliable full host compromise with no extra escape work, it would move up fast. Likewise, if the vulnerable surface were unauthenticated and internet-reachable without user clicks, this would not stay medium.

Why not lower?

It is still a browser memory-corruption flaw in one of the most common endpoint applications in the enterprise. Chrome is a massive exposure surface, and if the exploit matures, attackers can target users at scale through ordinary web traffic rather than needing prior access.

1. Enforce rapid Chrome auto-update — Make sure Windows endpoints are actually pulling Chrome 149.0.7827.53 or later via enterprise update policy and management tooling. For a MEDIUM verdict there is no noisgate mitigation SLA — go straight to the 365-day remediation window, but in practice browsers should not sit unpatched anywhere near that long because update automation is cheap and high leverage.
2. Tighten web content filtering — Block newly registered domains, malicious ad categories, and known phishing delivery infrastructure to reduce the odds that users ever render exploit pages. This is your best temporary exposure reducer while update laggards are being cleaned up; deploy as standard control hardening, not as an emergency-only measure.
3. Hunt for outdated Chrome on Windows — Prioritize unmanaged laptops, VDI gold images, kiosk systems, and exception-based update rings. Those pockets are where browser CVEs survive long enough to become useful to attackers, even when the main fleet auto-updates.
4. Watch for browser-to-payload transitions — Alert on unusual child processes from chrome.exe, suspicious downloads, script interpreters, and credential-store access immediately following browser activity. This does not prevent the bug, but it shortens dwell time if someone does land code execution.

Run this on the target Windows endpoint or through your RMM/EDR live-response shell. Invoke with powershell.exe -ExecutionPolicy Bypass -File .\check-chrome-cve-2026-11117.ps1; standard user rights are usually enough to read file versions, admin is not required.

# check-chrome-cve-2026-11117.ps1

# Purpose: Determine whether Google Chrome on Windows is vulnerable to CVE-2026-11117

# Output: VULNERABLE / PATCHED / UNKNOWN

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


$ErrorActionPreference = 'Stop'

function Get-ChromePaths {
    $paths = @(
        "$env:ProgramFiles\Google\Chrome\Application\chrome.exe",
        "$env:ProgramFiles(x86)\Google\Chrome\Application\chrome.exe",
        "$env:LocalAppData\Google\Chrome\Application\chrome.exe"
    )

    $regPaths = @(
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
        'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe'
    )

    foreach ($rk in $regPaths) {
        try {
            $item = Get-ItemProperty -Path $rk -ErrorAction Stop
            if ($item.'(default)') { $paths += $item.'(default)' }
            if ($item.Path) { $paths += (Join-Path $item.Path 'chrome.exe') }
        } catch {
            # Ignore missing registry keys

        }
    }

    $paths | Where-Object { $_ -and (Test-Path $_) } | Select-Object -Unique
}

function To-Version([string]$s) {
    try {
        return [version]$s
    } catch {
        return $null
    }
}

$fixedVersion = To-Version '149.0.7827.53'
if (-not $fixedVersion) {
    Write-Output 'UNKNOWN - could not parse fixed version'
    exit 2
}

$chromePaths = Get-ChromePaths
if (-not $chromePaths -or $chromePaths.Count -eq 0) {
    Write-Output 'UNKNOWN - chrome.exe not found'
    exit 2
}

$results = @()
foreach ($path in $chromePaths) {
    try {
        $item = Get-Item $path -ErrorAction Stop
        $verString = $item.VersionInfo.ProductVersion
        if (-not $verString) { $verString = $item.VersionInfo.FileVersion }
        if ($verString) {
            $verString = ($verString -split '\s+')[0]
        }
        $ver = To-Version $verString
        $results += [pscustomobject]@{
            Path = $path
            VersionString = $verString
            Version = $ver
        }
    } catch {
        $results += [pscustomobject]@{
            Path = $path
            VersionString = $null
            Version = $null
        }
    }
}

$valid = $results | Where-Object { $_.Version -ne $null }
if (-not $valid -or $valid.Count -eq 0) {
    Write-Output 'UNKNOWN - unable to read Chrome version'
    $results | ForEach-Object { Write-Output ("Path={0}; Version={1}" -f $_.Path, $_.VersionString) }
    exit 2
}

# If any installed Chrome is below fixed version, call it vulnerable.

$vuln = $valid | Where-Object { $_.Version -lt $fixedVersion }

if ($vuln) {
    Write-Output 'VULNERABLE'
    $vuln | ForEach-Object { Write-Output ("Path={0}; Version={1}; Fixed={2}" -f $_.Path, $_.VersionString, $fixedVersion) }
    exit 1
} else {
    Write-Output 'PATCHED'
    $valid | ForEach-Object { Write-Output ("Path={0}; Version={1}; Fixed={2}" -f $_.Path, $_.VersionString, $fixedVersion) }
    exit 0
}

Sources

1. Google Chrome stable channel update for Desktop (Chrome 149)
2. Official CVE JSON 5 record for CVE-2026-11117
3. Chromium issue 501403820
4. CISA Known Exploited Vulnerabilities Catalog
5. CISA KEV JSON feed
6. FIRST EPSS overview
7. FIRST EPSS API documentation
8. CIRCL vulnerability lookup entry