Security Resilience

CVE-2026-11082

Memory Safety in Google Chrome ≤ 149.0.7827.53

Memory Safety
Published
04 June 2026
Modified
23 July 2026
Patch / advisory
View advisory
CVSS Score v3.1 9.6
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS Score 0.0023 14th percentile
Risk Priority 66 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). EPSS, Forum of Incident Response and Security Teams (FIRST), epss.first.org. Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-11082 is a critical-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 9.6 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 14th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Race in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

CWE(s)
CWE-416

Related Threats

MITRE ATT&CK Enterprise Techniques

MITRE ATT&CK v20.0

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
attack.mitre.org →
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
T1499 Endpoint Denial of Service Impact
Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users.
attack.mitre.org →
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-7964Same product: Google Chrome
CVE-2026-13282Same product: Google Chrome
CVE-2024-8639Same product: Google Chrome
CVE-2026-13037Same product: Google Chrome
CVE-2026-11080Same product: Google Chrome
CVE-2023-0927Same product: Google Chrome
CVE-2026-10934Same product: Google Chrome
CVE-2026-11131Same product: Google Chrome
CVE-2023-2312Same product: Google Chrome
CVE-2026-10932Same product: Google Chrome

Affected Assets

google
chrome
≤ 149.0.7827.53

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 3 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V1.4.3

Mitigating Controls (NIST 800-53 r5)

Our mappings, made for this CVE.

SA-11 Developer Testing and Evaluation good match

Developer testing and evaluation can discover use-after-free bugs through dynamic analysis or fuzzing.

SA-8 Security and Privacy Engineering Principles partial match

Engineering principles can require memory-safe constructs or languages that structurally avoid introducing use-after-free.

SC-39 Process Isolation partial match

Process isolation confines the blast radius of use-after-free memory corruption to a single execution domain.

SI-16 Memory Protection partial match

Memory protection controls limit exploitation impact by blocking unauthorized code execution from dangling pointers.

Mitigating Controls (NIST CSF 2.0)

Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→CSF cross-walk — links open the control.

PR.PS-06 mostly match
blocks

Secure SDLC practices directly incorporate memory-safety tooling and reviews that prevent most use-after-free defects.

ID.RA-01 partial match
blocks

Vulnerability identification processes can discover use-after-free issues via scanning or analysis but do not prevent their introduction.

PR.PS-02 partial match
blocks

Routine patching removes known use-after-free instances after they have been introduced in released software.

Mitigating Controls (ISO/IEC 27001:2022 Annex A)

Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→ISO cross-walk — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing in development can detect use-after-free bugs before release.

A.8.28 Secure coding partial match
prevents

Secure coding standards directly prescribe avoidance of use-after-free patterns.

A.8.8 Management of technical vulnerabilities partial match
finds

A.8.8's reach is DISCLOSURE — it identifies vulnerabilities through published advisories, vendor notifications, and scanning against known vulnerability databases. UAF does commonly surface as CVEs (browsers, OS kernels, mobile platforms), so A.8.8 finds the disclosed share in third-party components, but the bulk of UAF instances live in custom first-party code that never receives a CVE and is invisible to A.8.8's reach — that source-reading work belongs to A.8.28/A.8.29, not here.

Hardening callouts derived

Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over our cross-walk; rows rated `none` are excluded, and each rule says how its mapping was checked.

Definition changed on 29 October 2026. Until then this section listed every rule rated above none, partial included. From that date it lists rules whose mapping is rated full or mostly and checked at llm_unverified or higher; partial mappings show when you ask.

Oracle Linux 8 (1 partial rule)
  • V-248592 OL 8 must clear memory when it is freed to prevent use-after-free attacks. blocks CWE-416
RHEL 8 (1 partial rule)
  • V-230279 RHEL 8 must clear memory when it is freed to prevent use-after-free attacks. blocks CWE-416
RHEL 9 (1 rule)
  • V-257794 RHEL 9 must clear memory when it is freed to prevent use-after-free attacks. blocks CWE-416

References