What is the CVSS score of CVE-2026-11003?

CVE-2026-11003 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11003?

Google Chrome contains a use-after-free vulnerability in WebRTC (CVE-2026-11003) enabling remote code execution within the browser sandbox when users visit crafted web pages.. A patch is available.

How to fix or mitigate CVE-2026-11003?

Within 24 hours: Audit Chrome deployment across organization (enterprise policies, auto-update status, version inventory). Within 7 days: Deploy Chrome 149.0.7827.53 or later via enterprise policy to all managed devices; verify auto-update enabled for unmanaged systems. Within 30 days: Complete compliance audit confirming zero systems below patched version.

Google Chrome CVE-2026-11003

EUVD-2026-34452 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-j24w-7hx2-m5m9

Google Memory Corruption RCE Use After Free Denial Of Service Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 03:00 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome versions prior to 149.0.7827.53 is possible through a use-after-free flaw in the WebRTC component, allowing a remote attacker to execute arbitrary code within the renderer sandbox when a victim visits a crafted HTML page. The issue carries a CVSS 3.1 score of 8.8 (High) and a vendor patch is available, though there is no public exploit identified at time of analysis and the flaw is rated Medium severity by Chromium's own security team.

Technical ContextAI

The vulnerability resides in WebRTC (Web Real-Time Communication), the open-source framework embedded in Chromium that handles peer-to-peer audio, video, and data channel communication directly in the browser. The root cause is CWE-416 (Use After Free), a memory corruption class in which an object is freed but a dangling pointer continues to reference it; subsequent operations on that pointer can lead to controlled memory writes, type confusion, or arbitrary code execution within the affected process. Because WebRTC code runs inside the sandboxed renderer process, successful exploitation grants attacker-controlled code execution constrained to the renderer's sandbox boundary, meaning a separate sandbox escape would typically be needed to fully compromise the host. Affected products are Chromium-based browsers on the desktop stable channel below build 149.0.7827.53.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 or later - install it by allowing Chrome's built-in auto-updater to run and then restarting the browser, or by manually triggering an update via chrome://settings/help, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. For managed fleets, push the updated MSI/PKG through your endpoint management platform and verify version compliance. If patching cannot be performed immediately, the most targeted compensating control is to disable WebRTC functionality via enterprise policy (e.g., WebRtcAllowLegacyTLSProtocols and related WebRTC policies, or by blocking WebRTC endpoints at the network egress) - note the trade-off that this breaks Google Meet, Teams calls in browser, Discord web, and any other voice/video application relying on WebRTC. Downstream Chromium-based browsers (Edge, Brave, Opera, Electron apps) should be updated as soon as their respective vendors ship the corresponding patched build.