CVE-2026-11094 is a use-after-free vulnerability (CWE-416) in the Codecs module of Google Chrome on Windows platforms before version 149.0.7827.53. Exploitation requires prior compromise of the renderer process and involves a crafted HTML page to potentially achieve sandbox escape. The vulnerability has a CVSS v3.1 base score of 9.6, indicating critical severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability. No official remediation level or patch link is explicitly stated in the provided data, but a vendor advisory URL is available for reference.

Successful exploitation could allow an attacker with control over the renderer process to escape the Chrome sandbox, potentially leading to full system compromise on affected Windows versions. The impact includes complete loss of confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution with untrusted content and consider applying any available updates promptly once released.