Google Chrome CVE-2026-11671

The victim must use a vulnerable Google Chrome desktop build prior to 149.0.7827.103 and must visit or be redirected to attacker-controlled HTML (UI:R in the CVSS vector - a single page load suffices, no clicks or downloads required). No authentication to the target system is needed (PR:N) and no special Chrome configuration is required since the bug lives in the default Navigation code path, but the attacker generally needs a companion renderer-compromise primitive to fully realize sandbox escape into useful code execution. Mitigating factors: Chrome's auto-update will close the window quickly for consumers who restart the browser, and the bug requires the user to actually load the malicious page rather than being wormable across the network.

The CVSS 9.6 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) describes a network-reachable, low-complexity, unauthenticated bug requiring only a user to load a page, with a changed scope that captures the sandbox escape. Chromium's own severity rating is High, consistent with sandbox escape impact. No EPSS score, KEV listing, or SSVC decision data was supplied, and no public POC is referenced, so the realistic risk profile is 'high-impact browser bug with broad attack surface but no confirmed in-the-wild exploitation yet.' Chrome's enormous install base and the historical pattern of Navigation/UAF bugs being chained into one-click RCE chains mean this should be treated as a priority patch even absent KEV confirmation; if KEV or active exploitation is later added by CISA or Google, urgency should escalate immediately.

An attacker hosts a malicious page (or compromises an ad network or a legitimate site via stored XSS) that delivers crafted HTML and JavaScript designed to trigger the Navigation use-after-free when the victim visits or is redirected to the page. Successful exploitation corrupts memory inside the browser process, allowing the attacker to escape the renderer sandbox and execute code with the browser's privileges on the user's machine, typically chained with a renderer RCE for a full one-click compromise. No public exploit was identified at time of analysis, though Chrome Navigation UAFs have historically been weaponized quickly once details are public.