CVE-2026-11002 is an use after free in the Autofill component of Google Chrome before 149.0.7827.53. NVD scores it 9.6 critical while Chromium rates it Medium. The record says a remote attacker could potentially escape the sandbox through a crafted HTML page. Update Chrome to 149.0.7827.53 or later.
What's affected
Google Chrome on Windows, Mac and Linux before 149.0.7827.53. Per the Chrome stable channel post, the fixed build is 149.0.7827.53 on Linux and 149.0.7827.53 or .54 on Windows and Mac.
Other Chromium based browsers take the fix on their own schedule, so check each vendor's release notes for the matching Chromium version before you assume you are covered.
How to check if you're exposed
Open chrome://settings/help and compare the version number with the fixed build above. The page also triggers the update check. On Linux you can read the installed version from a terminal:
google-chrome --version
For managed fleets, use your browser management console or endpoint inventory to list Chrome versions and filter for anything older than the fixed build. Chrome only applies an update after a relaunch, so a machine that has downloaded the update can still be running the old build.
What to do now
- Update Chrome to 149.0.7827.53 or later and relaunch the browser.
- Report browsers that have not relaunched in more than a few days, since they still run the old code.
- Check Chromium based browsers and embedded Chromium in desktop apps, and update them when the vendor ships the matching release.
- Keep automatic updates on, and avoid pinning old Chrome builds in managed images.
Why it matters
The weakness class is CWE-416. Autofill handles saved personal data, so a bug here deserves a quick patch even when the vector requires a prior renderer compromise.
The attacker needs a compromised renderer process first, so this is a second stage bug in a chain, not a standalone entry point. Browser bugs of this kind matter because the sandbox and site isolation are the main containment layers between a hostile web page and the rest of the machine. When one of them has a hole, the next bug in the chain gets more room to work.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and no advisory I read says it is exploited. Treat it as a routine but urgent update.
Quick check
Do I need to do anything besides update?
No special mitigation is described. Update and relaunch Chrome, then confirm the version on the About page.
Does this affect browsers other than Chrome?
It can, if they embed the same Chromium component. Check the vendor release notes for the Chromium version they have merged.
Sources
Last reviewed: 19 October 2026.
