Google Chrome CVE-2026-11634

Victim must visit an attacker-controlled or compromised web page in a vulnerable Chrome build on Windows (UI:R, user interaction required) - no authentication, no special site permissions, and no non-default configuration are needed, since the Gamepad API is exposed to any origin by default and does not require a prompt to enumerate devices. The vulnerability is limited to Chrome on Windows prior to 149.0.7827.103 per the advisory; macOS and Linux are not listed in the affected scope in the provided data. Practical exploitation as a full browser compromise typically requires a separate renderer-side memory corruption bug to pivot from, since the UAF itself is the sandbox-escape primitive rather than the initial code-execution primitive - a meaningful limiter on standalone weaponization.

All signals point to high real-world risk: CVSS 9.6 with AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H captures network-reachable, low-complexity, unauthenticated exploitation that only needs a user to load a page, and the scope change (S:C) reflects the sandbox escape crossing the renderer trust boundary. Chromium's own Critical severity rating is reserved for sandbox escapes and remote code execution at browser-process privilege, aligning with the CVSS. EPSS and CISA KEV data are not provided in the input, so exploitation probability and active-exploitation status cannot be confirmed from available data; no public exploit identified at time of analysis. The UI:R requirement (victim must visit a page) and the absence of confirmed in-the-wild exploitation slightly temper urgency relative to a zero-click bug, but browser sandbox escapes are routinely chained with renderer RCE bugs and historically attract rapid weaponization, so this should be treated as a priority patch.

An attacker hosts a malicious page (or compromises an ad network / watering-hole site) containing JavaScript that manipulates Gamepad API objects to trigger the use-after-free; when a victim on Windows visits the page with a vulnerable Chrome build, the freed memory is reclaimed under attacker control, allowing code execution in the higher-privileged browser process and escape from the renderer sandbox. Chained with a renderer RCE, this yields full code execution on the host at user privilege. No public exploit identified at time of analysis, but the Chromium issue tracker entry (516975148) will become public on Google's standard disclosure timeline.