Google Chrome CVE-2026-11652

Exploitation requires that the attacker has already compromised the Chrome renderer process - this is explicitly stated in the CVE description and is the gating prerequisite, meaning a second, separate renderer-side vulnerability or exploit primitive must be available. The user must also visit attacker-controlled content (UI:R in the CVSS vector), the attack complexity is High (AC:H), reflecting non-trivial heap-grooming or race conditions needed to land the UAF reliably, and the vulnerable code path lives in the Extensions subsystem of Chrome desktop versions below 149.0.7827.103. No authentication to any service is required (PR:N), but the chain is limited to users running unpatched Chrome on platforms covered by the Stable desktop channel; mobile Chrome and non-Chromium browsers are not in scope of this advisory.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H yields 8.3 and reflects the realistic preconditions: network reach, high attack complexity, no privileges, required user interaction (visiting a page), and a scope change consistent with a sandbox escape. Google's Chromium severity is High and a patch is shipping via the Stable channel update, but there is no CISA KEV listing, no EPSS score provided, and no public exploit identified at time of analysis, so this is currently a high-severity-but-not-confirmed-exploited issue. The description itself states the attacker must have already compromised the renderer process, meaning real-world weaponization requires chaining this bug with a separate renderer RCE - that materially lowers standalone risk while keeping it a priority patch for any organization that has previously seen Chrome exploited as a chain. No EPSS or SSVC data was supplied in the input, so probabilistic exploitation forecasts cannot be cited.

An attacker lures a user to a malicious or compromised website that first delivers a separate renderer-process exploit (the precondition stated in the CVE), then serves a crafted HTML page that triggers the Extensions use-after-free to pivot out of the sandbox into the browser process. From there the attacker gains code execution at the privilege level of the Chrome browser process, enabling credential theft, persistence, and further host compromise. No public exploit has been identified at time of analysis, but the bug class and Extensions component are historically attractive to commercial exploit developers building full Chrome chains.