Google Chrome CVE-2026-11682

The attacker must already control the renderer process - meaning a separate renderer-compromise vulnerability must be chained in first; this CVE alone does not give initial code execution. The victim must visit attacker-controlled content (UI:R: user interaction required, typically loading a crafted HTML page), the target must be running Chrome on Linux at a version below 149.0.7827.103, and the CVSS AC:H signals that the exploit relies on conditions outside the attacker's direct control such as specific timing, memory layout, or Views state. No authentication to Chrome or any service is required (PR:N). Limiting factors: the two-bug chain requirement, the Linux-only scope per the description, the High attack complexity, and the absence of any public PoC at time of analysis materially raise the bar above a single-click drive-by.

This is a meaningful but not top-tier urgency item. The CVSS vector AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H captures the dual-edged nature: scope change and full CIA impact justify the 8.3, but the High attack complexity (AC:H) plus required user interaction (UI:R) plus the implicit precondition of an already-compromised renderer mean exploitation is non-trivial and chained. There is no CISA KEV listing, no EPSS score provided, and no public exploit identified at time of analysis, suggesting this is not yet being weaponized in the wild. However, sandbox-escape bugs are exactly the class commercial spyware vendors and nation-state actors stockpile to pair with renderer RCEs, so the realistic risk to high-value targets (journalists, dissidents, executives) is materially higher than the absence-of-exploit signals suggest. Patch promptly, but it does not warrant the same emergency response as a single-bug unauthenticated RCE.

An attacker first lures a target to a malicious or compromised site that exploits a separate renderer-process bug (V8, Blink, WebGPU, etc.) to gain code execution inside the sandboxed renderer. From that foothold, the attacker delivers a crafted HTML page or payload that abuses the Views input-validation flaw across the renderer-to-browser IPC boundary, escaping the sandbox to run code in the browser process with the user's full privileges. No public exploit has been identified at time of analysis, but this is the standard renderer-RCE-plus-sandbox-escape pattern used by commercial exploit vendors.