Google Chrome CVE-2026-11656

The victim must install an attacker-controlled Chrome extension (UI:R in the CVSS vector), and that extension must execute crafted ServiceWorker code that drives the vulnerable allocation/free sequence to trigger the use-after-free - this is the explicit precondition stated in the description. Limiting factors: AC:H indicates non-trivial exploitation complexity (likely heap-grooming or race-window requirements typical of UAF sandbox escapes), exploitation is bounded to Chrome desktop builds before 149.0.7827.103, enterprise extension allowlist/blocklist policies neutralize the install vector, and Chrome Web Store review provides some friction against trivially malicious extensions. No authentication to any external service is required (PR:N), but the user-interaction and extension-install steps mean this is not opportunistically wormable.

The CVSS vector AV:N/AC:H/PR:N/UI:R reflects a network-reachable but high-complexity bug that requires user interaction (installing a malicious extension), and the scope change with C:H/I:H/A:H is what drives the 8.3 score. Real-world risk is moderated by the extension-install prerequisite: Chrome Web Store review, enterprise extension allowlists, and user friction all reduce the addressable population, so this is not a drive-by RCE. There is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was provided in the input - absent those signals, this should be treated as a high-priority patch (sandbox escapes are routinely chained with renderer bugs in real campaigns) but not an emergency on the level of an unauthenticated, no-UI Chrome zero-day. Targeted-attack scenarios (spearphishing engineers, supply-chain compromise of a legitimate extension) are the realistic threat model.

An attacker publishes or compromises a Chrome extension and convinces a target to install it via social engineering, a typosquatted listing, or a supply-chain takeover of a legitimate extension's developer account. Once installed, the extension issues crafted ServiceWorker operations that trigger the use-after-free, reclaim the freed allocation with attacker-controlled data, and pivot out of the extension sandbox into the broader Chrome process. No public exploit has been identified at time of analysis, but sandbox-escape primitives of this class are routinely chained with separate renderer bugs by mature actors.