Google Chrome CVE-2026-11673

The victim must use a Chrome build prior to 149.0.7827.103 and must visit or be navigated to an attacker-controlled HTML page (CVSS UI:R confirms required user interaction); the Protected Audience / InterestGroups feature must be reachable, which is the default on stable desktop Chrome but can be turned off via Privacy Sandbox enterprise policies or chrome://flags. No authentication is required (PR:N) and no prior foothold is needed (AV:N, AC:L). Limiting factors: code execution is confined to the renderer sandbox (Scope:Unchanged per CVSS), so meaningful host compromise requires chaining with a separate sandbox escape; enterprises that have already disabled Privacy Sandbox APIs via policy are not exposed to this code path.

CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates network-reachable exploitation with low complexity, no privileges, and required user interaction (visiting a page), with high impact across CIA but scope unchanged (code executes inside the sandbox). SSVC signals temper urgency: Exploitation=none and Automatable=no, though Technical Impact=total reflects full control within the affected component. The description explicitly notes execution is confined to the sandbox, which substantially limits real-world impact unless chained with a separate sandbox escape - a common pattern in Chrome exploit chains but not provided by this CVE alone. Not on CISA KEV and EPSS data is not provided in the input, so prioritization should be driven by Chrome's standard auto-update cadence rather than emergency response; nonetheless, browser memory-safety bugs of this class are routinely weaponized when chained, so patching promptly remains appropriate.

An attacker hosts or compromises a website that, when loaded by a victim, invokes the Protected Audience JavaScript APIs in a sequence crafted to trigger the use-after-free in InterestGroups; on the victim's vulnerable Chrome instance, the freed object is reallocated under attacker control and the dangling pointer is dereferenced to redirect execution to attacker shellcode running inside the renderer sandbox. No public exploit identified at time of analysis, and to break out of the sandbox the attacker would need to chain this with a separate sandbox escape vulnerability - typical of modern Chrome exploit chains used by commercial spyware vendors and APTs.