What is the CVSS score of CVE-2026-11002?

CVE-2026-11002 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11002?

Google Chrome contains a critical sandbox escape vulnerability affecting all users worldwide.. A patch is available.

How to fix or mitigate CVE-2026-11002?

Within 24 hours: Assess Chrome deployment scope across all endpoints and verify auto-update configuration status; communicate patch urgency to all users. Within 7 days: Deploy Google Chrome 149.0.7827.53 or later to all systems; prioritize user-facing workstations and shared machines. Within 30 days: Verify 100% patch compliance across the organization, document deployment records for compliance audits, and configure alerts for detection of exploitation attempts.

Google Chrome CVE-2026-11002

EUVD-2026-34451 CRITICAL

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-g9wg-9q28-6wx7

Denial Of Service Google Use After Free Memory Corruption

Critical

Disputed · 9.6 NVD

Severity by source

Sources disagree (Medium–Critical)

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Red Hat

8.2 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 02:07 vuln.today

CVSS changed

Jun 06, 2026 - 02:07 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

CRITICAL 9.6

DescriptionNVD

Use after free in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome's Autofill component prior to version 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. The flaw is a use-after-free (CWE-416) requiring user interaction (UI:R) and a chained renderer compromise, and no public exploit has been identified at time of analysis despite the very high 9.6 CVSS score driven by scope change.

Technical ContextAI

The vulnerability resides in Chrome's Autofill subsystem, which handles form field suggestions and data persistence across the browser process and renderer. Per CWE-416, a use-after-free occurs when memory is referenced after being freed, allowing an attacker controlling the freed object's contents to corrupt control flow or data structures. Because Autofill code runs partially in the privileged browser process, exploitation from a compromised renderer can pivot across the sandbox boundary - explaining the Scope:Changed (S:C) component of the CVSS vector. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome distributions prior to the fixed build.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - update via the stable channel update referenced at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and tracked at https://issues.chromium.org/issues/494740162. Enterprise administrators should push the update through Google Update, Chrome Browser Cloud Management, or their managed software distribution system and confirm the in-browser About Chrome version reads 149.0.7827.53 or higher. As a compensating control until patching, disable Autofill via enterprise policy (AutofillAddressEnabled=false, AutofillCreditCardEnabled=false, PasswordManagerEnabled scope as appropriate) - trade-off is loss of user productivity for stored form data. For downstream Chromium browsers, monitor the respective vendor channels (Edge, Brave, Opera) for rebased builds and apply when available.