Executive brief
Google Chrome is a widely used web browser. A vulnerability in its WebSockets component could allow a remote attacker to execute malicious code on a user's computer if they visit a specially crafted website. While the exploit is limited by the browser's security sandbox, it could still lead to unauthorized actions or be used as part of a larger attack to compromise the system.
Technical details
A use-after-free (UAF) vulnerability exists in the WebSockets implementation of Google Chrome. The flaw is triggered when the browser incorrectly manages memory during WebSocket communications, allowing an attacker to reference memory after it has been freed. By tricking a user into visiting a malicious HTML page, a remote attacker can exploit this condition to achieve arbitrary code execution (ACE) within the context of the Chromium sandbox. The vulnerability was addressed in version 149.0.7827.53. Chromium developers classified this with a 'Medium' severity rating.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome version 149.0.7827.53 released to stable channel.
- 2026-06-04: disclosed: CVE-2026-11068 published.