Google Chrome CVE-2026-11659

Victim must be running Google Chrome on Linux at a version below 149.0.7827.103 and must load attacker-controlled HTML content (UI:R in the CVSS vector - a click, navigation, opened tab, or iframe render is sufficient; no credentials or prior authentication are needed, PR:N). Exploitation is Linux-specific per the description; Windows and macOS builds are not implicated by the available data. Limiting factors are the user-interaction requirement, the Linux-only scope, and Chrome's default silent auto-update which closes the window quickly on unmanaged consumer endpoints - managed Linux desktops, kiosks, CI build agents running Chrome, and pinned-version deployments are the realistic targets.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H produces a 9.6 score driven primarily by the scope change (S:C) - the integer overflow in a UI-tier component crosses the sandbox boundary, which is exactly the property that elevates this above a typical renderer bug. Attack vector is network, complexity is low, and no authentication is required, but UI:R means a user must load attacker-controlled content (visit a page, open a tab), which is a low bar for drive-by attacks but still a real gating factor. EPSS is not provided in the input data and the CVE is not on CISA KEV, so there is no public exploitation signal yet; however, Chromium sandbox-escape bugs of this class historically attract rapid n-day weaponization once patches are diffed, so treat 'no public exploit identified at time of analysis' as a short-lived state rather than a stable risk floor. Chrome's silent-update channel mitigates much of the population-wide risk, but managed Linux fleets, kiosks, and air-gapped or pinned-version environments should treat this as priority patching.

An attacker hosts a malicious HTML page (or compromises an ad network / third-party script on a legitimate site) containing the crafted input that triggers the integer overflow in Chrome's Linux UI code. A Linux user running an unpatched Chrome navigates to the page - the required user interaction is simply loading the URL - and the overflow corrupts state in the browser process, breaking out of the renderer sandbox and allowing the attacker to execute code with browser-process privileges, from which credential theft, persistence, or pivoting to local privilege escalation chains becomes feasible. No public exploit identified at time of analysis, but the patch diff provides a starting point for n-day development.