What is the CVSS score of CVE-2026-11006?

CVE-2026-11006 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11006?

Yes, a patch is available for CVE-2026-11006. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11006

EUVD-2026-34455 MEDIUM

Out-of-bounds Read (CWE-125)

2026-06-04 chrome-cve-admin@google.com

GHSA-pfjw-jj6c-rrv7

Buffer Overflow Information Disclosure Google

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Red Hat

8.1 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 18:22 vuln.today

CVSS changed

Jun 06, 2026 - 18:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

DescriptionCVE.org

Out of bounds read in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Out-of-bounds read in Chrome's Dawn WebGPU subsystem (versions prior to 149.0.7827.53) allows unauthenticated remote attackers to read arbitrary memory contents by tricking a user into visiting a crafted HTML page. The vulnerability carries a CVSS 6.5 (Medium) with high confidentiality impact and no integrity or availability impact, indicating targeted data-disclosure potential rather than code execution. EPSS is 0.03% (11th percentile) and the vulnerability is not listed in the CISA KEV catalog - no public exploit has been identified at time of analysis.

Technical ContextAI

Dawn is Google's open-source WebGPU implementation, serving as Chrome's graphics API abstraction layer between web content and GPU hardware. CWE-125 (Out-of-bounds Read) occurs when code reads data outside the boundaries of an allocated memory buffer, potentially exposing adjacent heap or stack content - including pointers, session data, or cross-origin material - to the caller. In a browser GPU process context, such leaks can surface sensitive runtime state accessible to attacker-controlled JavaScript. The CVSS network attack vector (AV:N) reflects that the vulnerability is triggered entirely through web content delivery without requiring local system access. No CPE strings were included in the source data; affected scope is derived from the EUVD entry and NVD description.

RemediationAI

The primary remediation is upgrading Google Chrome to version 149.0.7827.53 or later, as detailed in the stable channel desktop update advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. For most end users, Chrome's built-in automatic update mechanism will apply this fix; users should verify their installed version via chrome://settings/help. Enterprise administrators should enforce the update through Google Admin Console or applicable group policies and confirm deployment via fleet management tooling. If immediate patching is operationally blocked, restricting or disabling WebGPU access via Chrome enterprise policy (e.g., setting WebGPU-related flags to disabled) may reduce exposure to the Dawn attack surface, though this carries the trade-off of breaking WebGPU-dependent web applications. No additional vendor-specified workarounds were included in the available advisory data.