CVE-2026-11651
A use‑after‑free bug in Google Chrome’s networking code lets a remote attacker run code inside the browser’s sandbox by loading a specially crafted web page. The flaw exists in Chrome versions before 149.0.7827.103 on Windows, macOS, and Linux. It can be triggered over the network without any user interaction beyond opening the page.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Google Chrome browsers older than version 149.0.7827.103 on Windows, macOS, and Linux. Users of these browsers are at risk.
Real-world impact
An attacker can execute arbitrary code inside the Chrome sandbox, potentially allowing them to read or modify data, capture credentials, or pivot to other systems on the same network.
Why this severity
The CVSS score of 9.6 reflects that the vulnerability can be exploited over the network (AV:N), requires minimal effort (AC:L), no special privileges (PR:N), and only a user who opens a malicious page (UI:R). The scope change (S:C) and high confidentiality, integrity, and availability impact (C:H/I:H/A:H) raise the score to critical.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jun 9, 2026 · Jun 9, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- chromereleases.googleblog.com/2026/06/stable-channel-upda…release notesvendor advisory
- issues.chromium.org/issues/511736002permissions required