Google Chrome CVE-2026-11661

Exploitation requires three concrete conditions: the victim must run Google Chrome on Windows at a version below 149.0.7827.103; the attacker must already have achieved code execution in the renderer process via a separate vulnerability (the CVE explicitly states the attacker has compromised the renderer); and the victim must visit or be navigated to a crafted HTML page (UI:R in the CVSS vector). Limiting factors include the High attack complexity (AC:H) reflecting the difficulty of reliably winning the UAF race in Views, the dependency on a chained renderer exploit, and the Windows-only scope per the description - non-Windows Chrome builds are not within the stated impact.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H yields 8.3 and reflects a chained-exploit posture: network reachable, no privileges required, but high attack complexity, user interaction (visiting a malicious page), and a scope change consistent with crossing the sandbox boundary. The description explicitly states the attacker must have already compromised the renderer process, so in practice this bug is only useful as the second link in a chain after a separate renderer RCE. EPSS, KEV status, and public POC availability are not provided in the input data, and the bug is not listed in CISA KEV; combined with the High complexity and renderer-compromise prerequisite, real-world risk is meaningful for targeted attackers (especially nation-state and exploit brokers who routinely chain Chrome bugs) but below the urgency of a single-click unauthenticated RCE.

An attacker first delivers a separate renderer-RCE exploit through a malicious or compromised website that the victim visits in Chrome on Windows. With code execution inside the sandboxed renderer, the attacker serves crafted HTML that drives the browser process's Views code into the use-after-free condition, reclaims the freed object with attacker-controlled data, and pivots to code execution in the unsandboxed browser process - yielding full user-level access to the workstation. No public exploit is identified at time of analysis, but the bug pattern is well-suited to chained exploitation by sophisticated actors.