What is the CVSS score of CVE-2026-11009?

CVE-2026-11009 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11009?

Google Chrome versions prior to 149.0.7827.53 contain a critical sandbox escape vulnerability affecting Windows users, potentially enabling remote code execution through malicious web pages accessed…. A patch is available.

How to fix or mitigate CVE-2026-11009?

24 hours: Confirm Chrome 149.0.7827.53 availability in your environment and issue high-priority update notification to all Windows users with mandatory patching deadline. 7 days: Deploy patch to test environments and non-critical systems; validate functionality and configure auto-update enforcement where policy permits. 30 days: Complete full deployment across all Windows systems running Chrome, confirm 100% remediation through inventory audit, and document patch completion.

Google Chrome CVE-2026-11009

EUVD-2026-34458 CRITICAL

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-h2r6-4fc2-h3jv

Denial Of Service Google Use After Free Memory Corruption Microsoft

Critical

Disputed · 9.6 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Red Hat

9.6 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 18:23 vuln.today

CVSS changed

Jun 06, 2026 - 18:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

CRITICAL 9.6

DescriptionCVE.org

Use after free in USB in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome on Windows versions prior to 149.0.7827.53 can be triggered by a remote attacker via a crafted HTML page that exploits a use-after-free condition in the USB component. The flaw carries a CVSS score of 9.6 due to its scope-changing impact, though Google rated the underlying Chromium security severity as Medium, and no public exploit has been identified at time of analysis with an EPSS score of just 0.03%.

Technical ContextAI

The vulnerability resides in Chrome's USB subsystem, which implements the WebUSB API allowing web pages to communicate with USB devices through the browser. CWE-416 (Use After Free) indicates that memory referencing a USB-related object is accessed after the object has been freed, typically resulting in undefined behavior that a skilled attacker can manipulate to corrupt memory and hijack control flow. Because USB device handling code runs with elevated privileges relative to the renderer sandbox on Windows, a successful exploit pivots from the constrained renderer process into the higher-privileged browser process, achieving sandbox escape. The Windows-specific nature suggests the bug involves platform-specific USB stack interactions or IPC handling between renderer and browser processes.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 for Windows - upgrade immediately via Chrome's built-in updater (chrome://settings/help) or through enterprise deployment tooling such as Chrome Browser Cloud Management, Group Policy, or SCCM. Enterprises managing fleets should verify rollout via the Chrome release notes at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and monitor the Chromium tracker at https://issues.chromium.org/issues/496233132. As a compensating control until patching completes, administrators can disable WebUSB via the DefaultWebUsbGuardSetting enterprise policy (set to 2 to block), which removes the attack surface entirely at the cost of breaking legitimate WebUSB-dependent web applications such as hardware key provisioning tools and some development workflows.