CVE-2026-11631 is a use-after-free vulnerability in the Aura subsystem of Google Chrome on Windows versions before 149.0.7827.103. Exploitation requires prior compromise of the renderer process and involves a crafted HTML page to potentially achieve sandbox escape. The vulnerability is critical in nature as it affects the security boundary of the sandbox, potentially allowing an attacker to execute code outside of the intended restricted environment. The CVSS v3.1 base score is 8.3, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring user interaction with high attack complexity.

Successful exploitation could allow an attacker who has compromised the renderer process to escape the Chrome sandbox on Windows, potentially leading to arbitrary code execution with higher privileges. This undermines the browser's security model and could facilitate further system compromise.

A vendor advisory is published by Google (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html) but does not explicitly confirm patch availability or remediation status. The affected versions are those prior to 149.0.7827.103. Users and administrators should update to version 149.0.7827.103 or later once confirmed available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.