Google Chrome CVE-2026-11679

Exploitation requires (1) the victim to load attacker-controlled HTML in Chrome for Windows prior to 149.0.7827.103 (UI:R - user interaction), and (2) the attacker to already have code execution inside the renderer process, as the description explicitly states 'a remote attacker who had compromised the renderer process' - meaning this CVE alone is not directly exploitable and must be chained with a separate renderer RCE. Limiting factors include the high attack complexity (AC:H - UAF reliability typically depends on heap grooming and timing/races), the Windows-only scoping per the description, and the requirement that the user actually navigate to the crafted page; non-Windows Chrome builds and patched Windows installs at 149.0.7827.103 or later are not exposed.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H produces 8.3 and accurately captures a multi-stage exploit chain: network reachable, high complexity (race/heap-grooming typical for UAF), no privileges, user must visit a page, and Scope:Changed because the bug crosses the renderer sandbox into the broader browser/OS trust boundary. The 'compromised renderer process' precondition in the description means this CVE is realistically a second-stage bug used together with a separate renderer RCE - it is not a one-shot drive-by on its own, which tempers raw urgency. It is not listed in CISA KEV and no public PoC was identified, but Chrome sandbox escapes are routinely chained by commercial spyware and crimeware, so n-day exploitation after patch diffing is plausible; EPSS data was not provided. Net: high priority for any Windows endpoint fleet running Chrome, even though the CVSS-vs-real-world signals suggest targeted rather than mass exploitation today.

An attacker first lands a separate renderer-process compromise (for example through a JavaScript engine or DOM bug) when the victim visits a malicious or compromised site in Chrome on Windows. From inside the sandboxed renderer, the attacker delivers a crafted HTML/media payload that triggers the Codecs use-after-free along a code path reachable from the renderer, grooming the heap to gain control of execution and escape into the higher-privileged browser process, achieving code execution outside the sandbox. No public exploit identified at time of analysis, but the bug class and 'sandbox escape' framing are typical building blocks in chained browser exploits.