Executive brief
Google Chrome is a widely used web browser. A vulnerability in how the browser handles fonts on Linux systems could allow a malicious website to execute unauthorized code. While the exploit is limited by the browser's security sandbox, it could still lead to data exposure or be used as part of a larger attack to compromise the user's computer.
Technical details
A use-after-free (UAF) vulnerability exists in the Fonts component of Google Chrome on Linux. The flaw is triggered when the browser incorrectly manages memory during the processing of font resources, allowing an attacker to potentially reuse memory after it has been freed. By enticing a user to visit a malicious website containing a crafted HTML page, a remote attacker can achieve arbitrary code execution within the renderer process sandbox. This vulnerability was addressed in version 149.0.7827.53.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released for Linux
- 2026-06-04: disclosed: CVE-2026-11000 published