Executive brief
A vulnerability in Google Chrome's Blink rendering engine could allow a remote attacker to execute unauthorized code on a user's computer. This occurs when a user visits a specially crafted, malicious website. While the exploit is limited by the browser's security sandbox, it could still lead to unauthorized data access or further system compromise if combined with other flaws.
Technical details
A use-after-free (UAF) vulnerability exists in the Blink rendering engine of Google Chrome prior to version 149.0.7827.53. The flaw is triggered when the browser incorrectly manages memory for objects within the DOM or rendering pipeline, allowing an attacker to reference memory after it has been freed. By enticing a user to visit a maliciously crafted HTML page, a remote attacker can exploit this condition to achieve arbitrary code execution (ACE) within the context of the browser's sandboxed process. This vulnerability is tracked as CWE-416. Users are advised to update to version 149.0.7827.53 or later to mitigate the risk.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel.
- 2026-06-04: disclosed: CVE-2026-11059 published.