Use after free in Chromoting in Google Chrome on Linux prior to 149

CVE-2026-11224 is a CWE-416 use-after-free in Chrome's Chromoting component on Linux. The affected range is Google Chrome on Linux before 149.0.7827.53; Google promoted 149.0.7827.53 to Stable for Linux on 2026-06-02, and NVD published the CVE on 2026-06-04. The bug is described as remote code execution via malicious network traffic, which means the vulnerable code path is reached through Chrome's remote-desktop/remoting stack rather than a generic web page render path.

Vendor scoring overstates the enterprise patch emergency here. 8.1/HIGH is fair in a lab because unauthenticated remote memory corruption can end in code execution, but in production this is Linux-only, tied to the Chromoting feature path, not broadly internet-enumerable like an appliance bug, and currently has no KEV listing, no public exploitation evidence, and a very low EPSS (0.00159). Google also labels the bug Low in its release notes, which better matches the real deployment friction than the abstract CVSS math.

Why this verdict

• Downward adjustment: Linux-only scope cuts the exposed fleet materially versus a cross-platform Chrome bug.
• Downward adjustment: feature-specific reachability means the attacker needs the Chromoting path, not just any browser tab or public web endpoint.
• Downward adjustment: high attack complexity is explicit in the current CVSS vector and is typical for reliable modern Chrome memory-corruption exploitation.
• Downward adjustment: no KEV, no public campaign data, no public PoC found removes the strongest real-world urgency signals.
• Upward adjustment: impact is still real because a remote unauthenticated memory corruption that can become code execution on a managed endpoint is not backlog noise.

Why not higher?

It is not higher because the path assumes a much narrower attacker position than the score headline suggests: the attacker needs a reachable Linux target using the vulnerable Chromoting flow, then must land a high-complexity memory-corruption exploit. That is worlds apart from a web-facing edge appliance bug or an every-user drive-by renderer issue.

Why not lower?

It is not lower because, where the feature is enabled and reachable, the bug can plausibly end in remote code execution without credentials. Linux engineering workstations, support boxes, and shared admin desktops can still have meaningful blast radius even if population-wide exposure is limited.

1. Disable Chromoting where it is not required — Remove or disable Chrome Remote Desktop/Chromoting on Linux endpoints that do not need it. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but this is the highest-value compensating control for high-risk Linux admin and support workstations.
2. Constrain remote-support network paths — Restrict outbound and inbound remoting/signaling traffic to approved brokers, VPN paths, and managed support subnets. This reduces the chance that arbitrary external traffic can ever reach the vulnerable code path; use it where patch deployment on Linux desktops lags.
3. Prioritize high-value Linux desktops — Flag developer workstations, jump boxes with GUI sessions, SOC analyst Linux desktops, and remote support endpoints for earlier patching. The bug is population-narrow, so the right move is to front-load the small number of Linux systems that actually matter.
4. Hunt for Chrome crash and child-process anomalies — Alert on repeated chrome or chrome-remote-desktop crashes, coredumps, and unexpected child processes such as shells, scripting engines, or download tools. This will not prevent exploitation, but it improves the odds of catching exploit development attempts and failed weaponization.

Run this on the Linux target host itself or through your endpoint management agent. Invoke as bash check_cve_2026_11224.sh; it needs no root privileges. It checks Google Chrome version locally and returns VULNERABLE, PATCHED, or UNKNOWN with exit codes for automation.

#!/usr/bin/env bash
# check_cve_2026_11224.sh
# Detects whether Google Chrome on Linux is vulnerable to CVE-2026-11224
# Affected: Google Chrome on Linux < 149.0.7827.53
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

set -u

FIXED="149.0.7827.53"
FOUND_BIN=""
FOUND_VER=""

candidates=(
  "/usr/bin/google-chrome"
  "/usr/bin/google-chrome-stable"
  "/opt/google/chrome/google-chrome"
)

for bin in "${candidates[@]}"; do
  if [ -x "$bin" ]; then
    FOUND_BIN="$bin"
    break
  fi
done

if [ -z "$FOUND_BIN" ]; then
  echo "UNKNOWN: Google Chrome binary not found in standard locations; this script only assesses Google Chrome on Linux."
  exit 2
fi

raw_ver="$($FOUND_BIN --version 2>/dev/null || true)"
FOUND_VER="$(printf '%s' "$raw_ver" | grep -Eo '[0-9]+(\.[0-9]+){3}' | head -n1)"

if [ -z "$FOUND_VER" ]; then
  echo "UNKNOWN: Unable to parse Chrome version from: $raw_ver"
  exit 2
fi

ver_lt() {
  # returns 0 if $1 < $2
  if command -v dpkg >/dev/null 2>&1; then
    dpkg --compare-versions "$1" lt "$2"
    return $?
  fi
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" != "$2" ] && [ "$1" != "$2" ]
}

if ver_lt "$FOUND_VER" "$FIXED"; then
  echo "VULNERABLE: Google Chrome version $FOUND_VER is older than fixed version $FIXED ($FOUND_BIN)"
  exit 1
fi

echo "PATCHED: Google Chrome version $FOUND_VER is at or above fixed version $FIXED ($FOUND_BIN)"
exit 0

Sources

1. NVD CVE-2026-11224
2. Chrome Stable Channel Update for Desktop (2026-06-02)
3. Chromium issue 502461760
4. CISA Known Exploited Vulnerabilities Catalog
5. FIRST EPSS overview
6. FIRST EPSS API documentation
7. CWE-416 Use After Free