CVE-2026-11640 is an integer overflow vulnerability in the libyuv library used by Google Chrome versions before 149.0.7827.103. Exploiting this flaw requires prior compromise of the renderer process and could enable an attacker to perform a sandbox escape, thereby increasing their privileges beyond the renderer sandbox. The vulnerability has a CVSS 3.1 base score of 8.3, indicating high severity, with attack vector network, high attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability. The vendor has published an advisory linked to a stable channel update for desktop Chrome.

Successful exploitation can lead to sandbox escape from the renderer process, allowing an attacker to gain elevated privileges and potentially execute arbitrary code outside the sandbox. This increases the risk of system compromise beyond the browser sandbox protections. The vulnerability affects confidentiality, integrity, and availability of the affected system.

A fixed version is available in Google Chrome 149.0.7827.103. Users and administrators should update to this version or later to remediate the vulnerability. The vendor advisory linked provides the official update details. No additional mitigations are indicated by the vendor advisory.