What is the CVSS score of CVE-2026-11000?

CVE-2026-11000 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11000?

Google Chrome on Linux versions prior to 149.0.7827.53 contain a critical remote code execution vulnerability (CVE-2026-11000, CVSS 8.8) that users can trigger simply by visiting attacker-controlled…. A patch is available.

How to fix or mitigate CVE-2026-11000?

24 hours: Issue mandatory security advisory identifying CVE-2026-11000. Query asset inventory tools for Linux systems running Chrome and identify all instances below version 149.0.7827.53. Initiate deployment of Chrome version 149.0.7827.53 or later through enterprise update mechanisms. 7 days: Complete patch deployment to 100% of managed Linux systems running Chrome. For unmanaged systems or those unable to auto-update, document them and implement interim network-based controls (e.g., restrict untrusted site access). 30 days: Validate full patching compliance across all Linux infrastructure running Chrome. Establish automated compliance monitoring to enforce timely patch deployment for future critical vulnerabilities.

Google Chrome CVE-2026-11000

EUVD-2026-34449 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-67fq-cppq-c8jr

RCE Denial Of Service Google Use After Free Memory Corruption

High

Disputed · 8.8 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

8.8 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 03:00 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Fonts in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome on Linux prior to 149.0.7827.53 allows attackers to execute arbitrary code within the renderer sandbox by luring a user to a malicious web page that triggers a use-after-free condition in the Fonts component. The flaw carries a CVSS 3.1 base score of 8.8 (High) and no public exploit identified at time of analysis, though Chromium memory-corruption issues historically attract rapid POC development. Exploitation requires user interaction (visiting attacker-controlled content) but no authentication.

Technical ContextAI

The vulnerability resides in Chrome's Fonts subsystem, which is part of the Blink rendering engine responsible for parsing, shaping, and rasterizing font data referenced by HTML and CSS. CWE-416 (Use After Free) indicates that the code retains a pointer to a heap object after that object has been freed, allowing subsequent dereferences to operate on attacker-controllable reused memory - a classic primitive for arbitrary read/write and ultimately arbitrary code execution in the renderer process. Although code execution is constrained to inside Chromium's sandbox (Scope:Unchanged in the CVSS vector confirms no privilege boundary crossing), the renderer process still has access to all browsing session data, credentials in memory, and serves as the typical first stage of a multi-bug sandbox escape chain on Linux builds of Chrome.

RemediationAI

Upgrade Google Chrome on Linux to version 149.0.7827.53 or later - vendor-released patch: 149.0.7827.53, distributed via the Stable channel update referenced at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Restart all Chrome instances after update to ensure the patched binary is loaded, since Chrome runs the prior version until a full relaunch. If immediate patching is not feasible, compensating controls include disabling JavaScript on untrusted origins via enterprise policy (breaks most modern web applications), enforcing Site Isolation (already default on Linux desktop builds, limits cross-origin reach of a compromised renderer), and using URL allowlisting to constrain browsing to vetted destinations (high operational overhead). Users of downstream Chromium-based browsers on Linux should monitor their vendor advisories for the corresponding merge of the Chromium fix.