Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.6
CVE-2026-11651: Google Chrome Sandbox Bypass via Malicious HTML Page
CVE-2026-11651 · published 4 months ago
Summary
A security issue in Google Chrome prior to version 149.0.7827.103 allows a hacker to potentially take control of your computer by tricking you into visiting a malicious website. This could happen even if the website is opened within a 'safe' environment. To protect yourself, update Google Chrome to the latest version.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | chromium | All versions |
| Debian:12 | debian | chromium | All versions |
| Debian:13 | debian | chromium | All versions |
| Debian:14 | debian | chromium | All versions |
Original advisory text
Use after free in Network in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Use after free in Network in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.6
Critical
Type
CWE-416Use After Free
Timeline
Published9 Jun 2026
Updated4 Nov 2026
First seen9 Jun 2026
Track software like this
Free during beta