What is the CVSS score of CVE-2026-10911?

CVE-2026-10911 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10911?

Google Chrome versions before 149.0.7827.53 contain a vulnerability that allows attackers to escape browser sandbox protections and potentially compromise entire endpoints.. A patch is available.

How to fix or mitigate CVE-2026-10911?

Within 24 hours: Inventory all Chrome deployments and current versions across the organization. Within 7 days: Deploy Chrome 149.0.7827.53 or later to all endpoints using standard patch management processes, prioritizing systems handling sensitive data or running privileged operations. Within 30 days: Validate 100% patch compliance using endpoint management tools and conduct security awareness training regarding malicious website risks.

Google Chrome CVE-2026-10911

EUVD-2026-34360 HIGH

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-q65q-78v7-jv3p

Information Disclosure Google

8.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:33 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.3 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.3

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page abusing the Media component. Google rates the issue High severity and a vendor patch is available, though no public exploit has been identified at time of analysis.

Technical ContextAI

The flaw resides in Chrome's Media subsystem, which handles audio/video decoding, playback, and related IPC between the renderer and browser process. CWE-20 (Improper Input Validation) indicates that data crossing the renderer-to-broker boundary is not adequately validated, enabling a renderer with attacker control to manipulate Media-layer logic and escape the sandbox confinement that normally isolates web content from the host OS. Chromium's sandbox is a defense-in-depth boundary, so a flaw here breaks one of the browser's most critical security guarantees and affects the same engine shipped in Chrome and Chromium-derived browsers.

RemediationAI

Update to Google Chrome 149.0.7827.53 or later on all desktop platforms per the Stable Channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html; this is the vendor-released patch and is the only complete fix. Force-restart browsers after the update to ensure the new binary is loaded, and verify Chromium-derived browsers (Edge, Brave, Opera, Electron-based apps) have picked up an equivalent merge before considering them remediated. As a compensating control until rollout completes, enterprises can enforce Site Isolation (already default), enable the enhanced Safe Browsing setting, and restrict browsing to allowlisted domains via group policy - these reduce the likelihood of encountering a chained renderer-RCE payload but do not prevent exploitation if a user visits a malicious page.