CVE-2026-11115 is a use-after-free vulnerability (CWE-416) in the Updater component of Google Chrome on Windows platforms before version 149.0.7827.53. This vulnerability enables a local attacker to perform OS-level privilege escalation by exploiting improper memory handling via a crafted malicious file. The CVSS 3.1 base score is 7.3, reflecting high impact on confidentiality, integrity, and availability. The vulnerability was publicly disclosed on June 4, 2026. The official Google Chrome stable channel update blog is referenced but does not explicitly state patch availability or remediation details.

Successful exploitation of this vulnerability allows a local attacker to escalate privileges on the affected Windows system, potentially gaining higher-level access to the operating system. This can lead to full compromise of the affected machine, impacting confidentiality, integrity, and availability of system resources.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until an official fix is confirmed, restrict local access to trusted users only and monitor for suspicious activity related to the Chrome Updater component.