Use after free in Extensions in Google Chrome prior to 149

CVE-2026-11230 is a use-after-free in Chrome's Extensions code affecting Google Chrome before 149.0.7827.53. A victim has to load attacker-controlled HTML, after which the attacker can gain arbitrary code execution inside Chrome's sandbox, not native code execution on the host outside the browser boundary. Based on the available public description, this is a client-side memory corruption issue with broad endpoint reach because Chrome is everywhere, but the affected range is straightforward: anything older than 149.0.7827.53.

The vendor/NVD-style 8.8 HIGH score is technically defensible if you grade only the bug primitive, but it overstates enterprise host risk. The decisive friction is the same one Google hints at with its own lower component severity: the code runs inside the sandbox. That means this is usually step one of a chain, not the full chain. No KEV entry, no public exploitation evidence, and a very low EPSS all push this down from emergency patch territory to routine-but-real browser patching.

Why this verdict

• Downgrade: sandbox boundary matters — the public description says code execution is *inside a sandbox*, which means this is usually a browser foothold rather than full workstation compromise.
• Downgrade: no live-fire evidence — no KEV listing, no public exploitation evidence, and a user-provided EPSS of 0.0008 all argue against emergency prioritization.
• Downgrade: exploit delivery needs a human — UI:R means the attacker still needs page view traffic, which modern email/web controls suppress at scale.
• Offsetting upward pressure: Chrome is ubiquitous — because Chrome is widely deployed, even a sandboxed browser bug can still produce meaningful identity/session risk across a large fleet.

Why not higher?

A higher rating would require either evidence of exploitation, a public reliable exploit, or impact outside the sandbox. We do not have that here. As currently described, this is not a one-bug domain-wide disaster; it is a client-side exploit primitive that still needs additional help to become an endpoint takeover.

Why not lower?

This is still remote, unauthenticated, and broadly reachable through normal browsing. Even sandboxed execution can expose sensitive in-browser data, sessions, and application activity. On a 10,000-host fleet, you do not ignore browser memory corruption just because it stops at the sandbox.

1. Force browser auto-update compliance — Verify policy enforcement so Chrome cannot lag behind the fixed build. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but for browsers you should still use your normal rapid update ring instead of letting drift accumulate.
2. Tighten web filtering on untrusted categories — Reduce exposure to exploit delivery by blocking newly registered domains, known-malvertising sources, and uncategorized destinations. This is a useful risk reducer while patch rollout completes, even though there is no noisgate mitigation deadline for MEDIUM.
3. Restrict extension sprawl — Use enterprise allowlisting and remove unnecessary extensions. The flaw sits in the Extensions area, and while the public details are sparse, reducing extension surface is sensible hardening during the remediation window.
4. Watch for browser crash anomalies — Sudden Chrome crash clusters after exposure to the same sites can be an early sign of exploit development or failed attempts. Feed crash telemetry, proxy logs, and EDR browser events into hunting while you patch.

Run this on the target endpoint or through your software-distribution/remote-exec tooling. Invoke it with python3 chrome_cve_2026_11230_check.py; it needs only normal user rights because it reads local Chrome version information and compares it to the fixed build 149.0.7827.53.

#!/usr/bin/env python3
# Check Google Chrome version for CVE-2026-11230
# Outputs: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys

FIXED = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_str(v):
    return '.'.join(str(x) for x in v)


def get_version_from_command(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        out = (p.stdout or '') + ' ' + (p.stderr or '')
        return parse_version(out)
    except Exception:
        return None


def get_windows_version():
    candidates = [
        ["reg", "query", r"HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe", "/ve"],
        ["reg", "query", r"HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe", "/ve"],
    ]
    exe_path = None
    for cmd in candidates:
        try:
            p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
            data = (p.stdout or '') + (p.stderr or '')
            m = re.search(r'REG_SZ\s+(.*chrome\.exe)', data, re.IGNORECASE)
            if m:
                exe_path = m.group(1).strip()
                break
        except Exception:
            pass

    common_paths = [
        exe_path,
        r"C:\Program Files\Google\Chrome\Application\chrome.exe",
        r"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe",
    ]
    for path in common_paths:
        if path and os.path.exists(path):
            v = get_version_from_command([path, "--version"])
            if v:
                return v
    return None


def get_macos_version():
    path = "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"
    if os.path.exists(path):
        return get_version_from_command([path, "--version"])
    return None


def get_linux_version():
    for binary in ["google-chrome", "google-chrome-stable", "chromium", "chromium-browser"]:
        full = shutil.which(binary)
        if full:
            v = get_version_from_command([full, "--version"])
            if v:
                return v
    return None


def main():
    system = platform.system().lower()
    version = None

    if 'windows' in system:
        version = get_windows_version()
    elif 'darwin' in system:
        version = get_macos_version()
    elif 'linux' in system:
        version = get_linux_version()

    if version is None:
        print("UNKNOWN: Could not determine Chrome version on this host")
        sys.exit(2)

    if version < FIXED:
        print(f"VULNERABLE: Detected Chrome {version_str(version)} < {version_str(FIXED)}")
        sys.exit(1)
    else:
        print(f"PATCHED: Detected Chrome {version_str(version)} >= {version_str(FIXED)}")
        sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Google Chrome Releases - Early Stable Update for Desktop
2. Google Chrome Releases - Stable Channel Update for Desktop (May 12, 2026)
3. Chromium issue tracker reference
4. CISA Known Exploited Vulnerabilities Catalog
5. FIRST EPSS overview
6. FIRST EPSS API documentation
7. CWE-416: Use After Free
8. SynScan CVE mirror for CVE-2026-11230