Executive brief
A vulnerability in Google Chrome's Blink rendering engine could allow a remote attacker to execute unauthorized code on a user's computer. This occurs when a user visits a specially crafted website, potentially leading to the compromise of the browser's security sandbox. While the exploit is contained within the sandbox, it represents a significant step in a multi-stage attack that could lead to data theft or further system access.
Technical details
A use-after-free (UAF) vulnerability exists in the Blink rendering engine of Google Chrome prior to version 149.0.7827.53. The flaw is triggered when the browser incorrectly manages memory for objects within the DOM or rendering pipeline, allowing an attacker to reference memory after it has been freed. By enticing a user to visit a maliciously crafted HTML page, a remote attacker can exploit this condition to achieve arbitrary code execution (ACE) within the context of the Chromium sandbox. This vulnerability is tracked as CWE-416. Users are advised to update to version 149.0.7827.53 or later to mitigate the risk.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel.
- 2026-06-04: disclosed: CVE-2026-11164 published.