Google Chrome CVE-2026-11643

Exploitation requires the victim's Chrome browser to process malicious network traffic handled by the Proxy component - typically reachable when the user visits an attacker-controlled site, connects through an attacker-controlled or MITM-capable network path, or uses a PAC (Proxy Auto-Config) URL that returns hostile content. No authentication or explicit user interaction is required per the CVSS vector (PR:N/UI:N), though the victim must run a vulnerable Chrome build (<149.0.7827.103) and have network traffic reach the affected Proxy code path. Limiting factors: AC:H reflects that reliable exploitation demands heap-grooming and precise timing, Chrome's renderer/network-service sandbox constrains post-exploit impact without a chained escape, and Scope is Unchanged (S:U) so compromise stays within the browser's security boundary until a second bug is added.

Signals are mixed but lean toward elevated priority. CVSS 8.1 with AV:N/AC:H/PR:N/UI:N indicates no authentication and no user interaction required, though the High attack complexity reflects the heap-grooming and timing required to weaponize a UAF reliably. Chromium internally rated this Critical, which typically correlates with sandbox-escape potential or pre-auth network-vector RCE - a stronger signal than the NVD score alone. EPSS data was not provided in the input, and the CVE is not listed in CISA KEV, so there is no public exploit identified at time of analysis. Given the Proxy attack surface is reachable via crafted PAC scripts, MITM proxy responses, or hostile network environments (e.g., captive portals, malicious Wi-Fi), realistic exploitation paths exist even without confirmed in-the-wild use. Treat as a priority browser update for fleets, especially endpoints that traverse untrusted networks.

An attacker operating a hostile Wi-Fi network, a compromised upstream proxy, or a malicious website lures a Chrome user to a page that triggers crafted proxy negotiation or returns a malicious PAC script response, manipulating heap state to free and reuse a Proxy object. The attacker grooms the heap so the dangling pointer references attacker-controlled data, achieving arbitrary code execution in the renderer or network service process; chained with a separate sandbox escape, this yields full host compromise. No public exploit identified at time of analysis, but UAFs in Chrome's network stack have historically been weaponized within weeks of disclosure.