Use after free in TabStrip in Google Chrome prior to 149

CVE-2026-11262 is a use-after-free in Chrome's TabStrip UI component. The affected desktop builds are Chrome versions before 149.0.7827.53 on Linux and before 149.0.7827.53/.54 on Windows and macOS, as documented in Google's June 2, 2026 stable release. In plain English: a malicious webpage can try to push the browser into reusing a stale UI object tied to tab handling, creating memory corruption conditions.

The user-provided HIGH 8.8 story overstates what matters for a 10,000-host patch queue. Google's own stable-channel advisory classifies this CVE as LOW, not HIGH, and that lines up better with reality: exploitation needs user-driven web content delivery, then a reliable browser-memory-corruption chain against a heavily hardened target, and there is no KEV entry, no observed in-the-wild exploitation, and an extremely low EPSS.

Why this verdict

• Baseline downshift: the user-supplied 8.8 HIGH is contradicted by Google's June 2, 2026 Chrome release, which labels CVE-2026-11262 as LOW.
• Attacker position matters: this is AV:N but also UI:R; the attacker needs a user to open crafted content, which implies a delivery stage that modern mail/web controls often break.
• Population is huge, but exposure is short-lived: Chrome is everywhere, yet enterprise auto-update and managed browser rollouts reduce dwell time for a single fixed desktop build.
• Exploit engineering burden is non-trivial: use-after-free in a modern browser is not copy-paste RCE; it needs heap shaping and mitigation bypasses, and there is no public PoC to lower the bar.
• Threat intel is cold: no KEV, no authoritative active-exploitation reporting, and an EPSS of 0.0008 all push urgency down.

Why not higher?

There is no credible evidence of exploitation, no public PoC, and the official Chrome release classifies this exact bug as LOW. A HIGH or CRITICAL call would require either active abuse, a public exploit chain, or materially less friction than a UI:R browser memory bug in a hardened target.

Why not lower?

It is still a browser memory-safety flaw delivered through normal web content, and Chrome's deployment footprint means even low-probability bugs can matter at fleet scale. If your browser estate is unmanaged or lags auto-update badly, the reachable population is large enough that this should stay above pure backlog hygiene.

1. Confirm browser inventory — Use EDR, MDM, or browser-management telemetry to identify hosts below 149.0.7827.53 (.54 also acceptable on Windows/macOS). For a MEDIUM noisgate verdict there is no mitigation SLA; do this in the normal remediation workflow so you can move straight into the 365-day patch window with accurate scope.
2. Force auto-update compliance — Verify Chrome update services, Omaha policies, and deferred-ring settings are not pinning endpoints below the fixed build. There is no mitigation SLA for MEDIUM, but tightening update compliance now prevents this class of browser issue from aging into long-tail exposure.
3. Reduce untrusted browsing paths — Keep Safe Browsing, web filtering, and mail URL protection enabled because they reduce the only practical first step: getting users onto attacker-controlled HTML. There is no mitigation SLA here; this is a standing control that lowers delivery success while the normal remediation cycle catches up.
4. Watch browser crash and child-process telemetry — Monitor for Chrome crashes, repeated renderer/browser instability, and suspicious browser-spawned processes on vulnerable hosts. There is no mitigation SLA for MEDIUM, but this is your best short-term detection control if you cannot immediately prove full patch coverage.

Run this on the target endpoint or through your software-distribution/EDR script runner. Invoke it as python3 chrome_cve_2026_11262_check.py on Linux/macOS or py chrome_cve_2026_11262_check.py on Windows; standard user rights are usually enough, though some locked-down Windows installs may require read access to Chrome registry/file metadata.

#!/usr/bin/env python3
# CVE-2026-11262 Chrome version check
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys

FIXED = (149, 0, 7827, 53)


def parse_version(text):
    if not text:
        return None
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_ge(a, b):
    return a >= b


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        out = (p.stdout or '') + '\n' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def get_versions_linux_macos():
    candidates = [
        ['google-chrome', '--version'],
        ['google-chrome-stable', '--version'],
        ['chromium', '--version'],
        ['chromium-browser', '--version'],
        ['/Applications/Google Chrome.app/Contents/MacOS/Google Chrome', '--version'],
    ]
    found = []
    for cmd in candidates:
        out = run_cmd(cmd)
        v = parse_version(out)
        if v:
            found.append((' '.join(cmd[:-1]), v))
    return found


def get_versions_windows():
    found = []

    reg_paths = [
        r'HKLM\Software\Google\Chrome\BLBeacon',
        r'HKCU\Software\Google\Chrome\BLBeacon',
        r'HKLM\Software\WOW6432Node\Google\Chrome\BLBeacon',
    ]
    for key in reg_paths:
        out = run_cmd(['reg', 'query', key, '/v', 'version'])
        v = parse_version(out)
        if v:
            found.append((key, v))

    powershell = [
        'powershell', '-NoProfile', '-Command',
        "$paths=@(\n" \
        "  $env:ProgramFiles+'\\Google\\Chrome\\Application\\chrome.exe',\n" \
        "  $env:'ProgramFiles(x86)'+'\\Google\\Chrome\\Application\\chrome.exe',\n" \
        "  $env:LocalAppData+'\\Google\\Chrome\\Application\\chrome.exe'\n" \
        "); foreach($p in $paths){ if(Test-Path $p){ try{ (Get-Item $p).VersionInfo.ProductVersion }catch{} } }"
    ]
    out = run_cmd(powershell)
    for line in out.splitlines():
        v = parse_version(line)
        if v:
            found.append(('chrome.exe', v))

    uniq = []
    seen = set()
    for name, ver in found:
        if ver not in seen:
            uniq.append((name, ver))
            seen.add(ver)
    return uniq


def main():
    system = platform.system().lower()
    if 'windows' in system:
        versions = get_versions_windows()
    else:
        versions = get_versions_linux_macos()

    if not versions:
        print('UNKNOWN: Google Chrome version not found')
        sys.exit(2)

    vulnerable = []
    patched = []
    for name, ver in versions:
        if version_ge(ver, FIXED):
            patched.append((name, ver))
        else:
            vulnerable.append((name, ver))

    def fmt(items):
        return ', '.join([f'{name}={".".join(map(str, ver))}' for name, ver in items])

    if vulnerable:
        msg = 'VULNERABLE: ' + fmt(vulnerable)
        if patched:
            msg += ' | Also found patched installs: ' + fmt(patched)
        print(msg)
        sys.exit(1)

    print('PATCHED: ' + fmt(patched))
    sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop (June 2, 2026)
2. Google Chrome Releases - Early Stable Update for Desktop (May 29, 2026)
3. Chromium issue 499386363
4. Chromium Chrome Security Page
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS API documentation
7. Google Chrome Releases - June 2026 archive
8. Google Chrome for Android Update (June 2, 2026; notes corresponding desktop security fixes)