Google Chrome CVE-2026-11644

The victim must be running Google Chrome on Linux at a version below 149.0.7827.103, and the attacker must convince that user to install a specifically crafted malicious Chrome Extension - this user-interaction requirement (UI:R) is the primary limiter. No prior authentication to any service is needed (PR:N), and the extension delivers the payload over the network from the attacker's distribution channel (AV:N). The CVSS attack complexity is High (AC:H), reflecting that reliably triggering the Views use-after-free requires specific heap layout/timing conditions rather than a one-shot deterministic crash. Non-Linux Chrome builds and Chrome installations already at 149.0.7827.103 or later are not exploitable via this CVE; enterprise environments that enforce ExtensionInstallBlocklist/Allowlist policies effectively neutralize the delivery path.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H yields 7.5 (High), driven down from Critical by AC:H (high complexity - likely heap-grooming required for reliable UAF exploitation) and UI:R (the victim must actively install the malicious extension). Google's internal Chromium severity of Critical signals a memory-corruption primitive with strong exploitation potential, but the real-world delivery requirement (convincing a user to side-load or install a hostile extension) substantially narrows the practical attack surface compared with a drive-by RCE. EPSS and KEV data were not provided in the input, so exploitation probability and active-exploitation status cannot be quantified here; no public exploit identified at time of analysis. Net assessment: a high-severity browser RCE worth prompt patching, but not a wormable zero-click bug - prioritize alongside other recent Chrome stable-channel fixes rather than as an emergency out-of-band response, while watching for KEV addition given Chrome's historical exploitation pattern.

An attacker publishes a Chrome extension that appears benign (e.g., a productivity or theme extension) and drives a user - via phishing, social engineering, or a typosquatted listing - to install it on a Linux Chrome build older than 149.0.7827.103. Once active, the extension issues a sequence of UI/state operations that trigger the Views use-after-free, grooms the heap, and pivots the dangling pointer into arbitrary code execution in the Chrome process context. Given AC:H the exploit is not trivial, but successful execution yields RCE on the user's Linux desktop without requiring a separate sandbox escape on top.