CVE-2026-11143 is a heap buffer overflow vulnerability in the Extensions component of Google Chrome on Linux. It allows an attacker to obtain potentially sensitive information from process memory by exploiting an out-of-bounds read condition via a crafted malicious Chrome extension. The vulnerability affects Chrome versions before 149.0.7827.53. The CVSS v3.1 base score is 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), indicating network attack vector with low complexity, no privileges required, user interaction needed, and high confidentiality impact without integrity or availability impact. There are no known exploits in the wild at this time. The vendor advisory linked does not explicitly confirm patch status or remediation level.

An attacker who convinces a user to install a malicious Chrome extension on Linux can exploit this vulnerability to read out-of-bounds memory, potentially exposing sensitive information from the Chrome process memory. This compromises confidentiality but does not affect integrity or availability of the system or browser.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Users should update to Chrome version 149.0.7827.53 or later once available. Until then, avoid installing untrusted or suspicious Chrome extensions, especially on Linux systems.