CVE-2026-11009 is a use-after-free vulnerability in the USB handling code of Google Chrome on Windows platforms. This memory corruption flaw allows a remote attacker to potentially escape the browser sandbox by delivering a specially crafted HTML page. The vulnerability is rated critical with a CVSS 3.1 base score of 9.6, reflecting its network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and high impact on confidentiality, integrity, and availability. The issue affects Chrome versions prior to 149.0.7827.53. Google has released a stable channel update to fix this vulnerability.

Successful exploitation could allow a remote attacker to escape the Chrome sandbox, potentially leading to full system compromise on affected Windows systems. The vulnerability impacts confidentiality, integrity, and availability at a high level. No known exploits in the wild have been reported at this time.

A fix is available in Google Chrome version 149.0.7827.53. Users and administrators should update affected Chrome installations to this version or later to remediate the vulnerability. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for detailed update instructions.