CVE-2026-11100 is a use-after-free vulnerability affecting the File Input feature in Google Chrome on Mac platforms before version 149.0.7827.53. Exploitation requires user interaction involving specific UI gestures on a maliciously crafted HTML page, which may lead to a sandbox escape. The vulnerability is rated critical with a CVSS 3.1 base score of 9.6, indicating high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported at the time of publication. The vendor has published an advisory linked to a stable channel update addressing this issue.

Successful exploitation can result in a sandbox escape, potentially allowing an attacker to execute code outside the browser's restricted environment. This can lead to full compromise of the affected system's confidentiality, integrity, and availability. The vulnerability requires user interaction but does not require privileges or prior access.

Users should update Google Chrome on Mac to version 149.0.7827.53 or later, where this vulnerability is fixed. The vendor advisory linked (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html) provides official update information. No alternative mitigations or temporary fixes are indicated. Patch status is confirmed by the vendor advisory.