Use after free in Omnibox in Google Chrome prior to 149

CVE-2026-11177 is a use-after-free in Chrome's Omnibox UI affecting Google Chrome before 149.0.7827.53 on Linux and before 149.0.7827.53/.54 on Windows and macOS. In plain English: a remote site can steer a user into a narrow browser-UI state, and if the user performs the required specific Omnibox interaction, Chrome can touch memory after it has already been freed.

The raw 8.8 / HIGH CVSS-style label overstates enterprise urgency for this one. Google’s own June 2, 2026 Chrome 149 release classified this bug as Chromium security severity: Medium, and that tracks reality better: this is still a real memory corruption issue in a massively deployed browser, but the chain is narrowed by UI:R, a specific gesture requirement, no public PoC, no KEV listing, and no evidence of in-the-wild abuse as of June 6, 2026.

Why this verdict

• Downward adjustment: requires user interaction plus a specific UI gesture — not just a page view, but a narrow Omnibox action path.
• Downward adjustment: client-side only — attacker reach depends on getting code in front of the user; there is no server-side, wormable, unauthenticated exposure surface.
• Downward adjustment: no public exploit signal — no KEV, no observed campaign reporting, no public PoC, and a very low EPSS.
• Upward adjustment: memory corruption in a ubiquitous browser still matters — Chrome is everywhere, so even a narrow exploit path can create meaningful fleet risk if patch hygiene is weak.

Why not higher?

Because every prerequisite compounds friction: the attacker needs remote content delivery, then the victim must perform a specific Omnibox gesture, then the bug must be made reliable enough to matter. That is not how mass browser exploitation usually looks when a bug is truly patch-now critical. There is also no evidence of public weaponization or active exploitation.

Why not lower?

Because it is still a use-after-free in a top-tier browser UI component, not a cosmetic spoofing issue. Even without public exploit code, memory-safety bugs in Chrome deserve patching attention across a large fleet, especially where auto-update and restart compliance are sloppy.

1. Enforce Chrome auto-update and restart compliance — Make sure endpoint policy actually lands Chrome 149+ and forces the browser to restart so the fix is loaded into memory. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but in practice browser bugs belong in the next normal endpoint/browser wave, not in a forgotten backlog.
2. Tighten browser-channel governance — Block unmanaged Chromium forks and stale portable browser installs so your inventory does not lie to you. There is no mitigation SLA here, but this control reduces the population that remains quietly vulnerable during the remediation window.
3. Use Safe Browsing, URL filtering, and mail-link detonation — These controls do not fix the bug, but they reduce the attacker’s ability to get crafted content in front of users. For this MEDIUM issue, treat this as exposure reduction while you complete patch rollout inside the remediation window.
4. Watch crash and browser anomaly telemetry — Collect Chrome crash spikes, EDR browser-memory alerts, and unusual browser child-process behavior to catch failed exploit attempts or testing. Again, no mitigation SLA applies, but this is cheap detection value for enterprises with large Chrome estates.

Run this on the target endpoint or through your software-distribution/EDR scripting channel. Invoke it as python3 check_chrome_11177.py on Linux/macOS or py check_chrome_11177.py on Windows; it needs only standard user rights and prints VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env python3
# check_chrome_11177.py
# Detect local Chrome/Chromium version and assess exposure to CVE-2026-11177.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys
from typing import Optional, Tuple, List

FIXED_MIN = (149, 0, 7827, 53)

WINDOWS_CANDIDATES = [
    r"C:\Program Files\Google\Chrome\Application\chrome.exe",
    r"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe",
    r"C:\Program Files\Chromium\Application\chrome.exe",
    r"C:\Program Files (x86)\Chromium\Application\chrome.exe",
]

MAC_CANDIDATES = [
    "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
    "/Applications/Chromium.app/Contents/MacOS/Chromium",
]

LINUX_CANDIDATES = [
    "google-chrome",
    "google-chrome-stable",
    "chromium",
    "chromium-browser",
    "/usr/bin/google-chrome",
    "/usr/bin/google-chrome-stable",
    "/usr/bin/chromium",
    "/usr/bin/chromium-browser",
]


def run_cmd(cmd: List[str]) -> Optional[str]:
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        out = (p.stdout or "") + "\n" + (p.stderr or "")
        return out.strip()
    except Exception:
        return None


def parse_version(text: str) -> Optional[Tuple[int, int, int, int]]:
    if not text:
        return None
    m = re.search(r"(\d+)\.(\d+)\.(\d+)\.(\d+)", text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_str(v: Tuple[int, int, int, int]) -> str:
    return ".".join(str(x) for x in v)


def compare_versions(a: Tuple[int, int, int, int], b: Tuple[int, int, int, int]) -> int:
    return (a > b) - (a < b)


def find_linux_binary() -> Optional[str]:
    for c in LINUX_CANDIDATES:
        if os.path.isabs(c) and os.path.exists(c):
            return c
        path = shutil.which(c)
        if path:
            return path
    return None


def find_windows_binary() -> Optional[str]:
    local_app = os.environ.get("LOCALAPPDATA")
    if local_app:
        user_candidate = os.path.join(local_app, "Google", "Chrome", "Application", "chrome.exe")
        if os.path.exists(user_candidate):
            return user_candidate
    for c in WINDOWS_CANDIDATES:
        if os.path.exists(c):
            return c
    return None


def find_mac_binary() -> Optional[str]:
    for c in MAC_CANDIDATES:
        if os.path.exists(c):
            return c
    return None


def get_binary_and_version() -> Tuple[Optional[str], Optional[Tuple[int, int, int, int]], Optional[str]]:
    system = platform.system().lower()

    if system == "windows":
        binary = find_windows_binary()
    elif system == "darwin":
        binary = find_mac_binary()
    else:
        binary = find_linux_binary()

    if not binary:
        return None, None, None

    output = run_cmd([binary, "--version"])
    ver = parse_version(output or "")
    return binary, ver, output


def main() -> int:
    binary, ver, raw = get_binary_and_version()

    if not binary:
        print("UNKNOWN: Chrome/Chromium binary not found")
        return 2

    if not ver:
        print(f"UNKNOWN: Could not parse version from {binary}")
        if raw:
            print(raw)
        return 2

    print(f"Detected: {binary}")
    print(f"Version: {version_str(ver)}")
    print(f"Fixed minimum for CVE-2026-11177: {version_str(FIXED_MIN)}")

    if compare_versions(ver, FIXED_MIN) < 0:
        print("VULNERABLE")
        return 1

    print("PATCHED")
    return 0


if __name__ == "__main__":
    sys.exit(main())

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop (Chrome 149)
2. Google Chrome Releases - June 2026 archive
3. Chromium issue reference for CVE-2026-11177
4. Chrome 149 release notes
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS overview
7. FIRST EPSS API documentation
8. Canadian Centre for Cyber Security advisory for Chrome 149 fixes