What is the CVSS score of CVE-2026-11012?

CVE-2026-11012 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-11012?

Google Chrome on Android versions before 149.0.7827.53 contain a sandbox escape vulnerability (CVSS 8.3) that allows attackers who have already compromised the browser's renderer process to escalate…. A patch is available.

How to fix or mitigate CVE-2026-11012?

Within 24 hours: Audit Chrome on Android deployment across organization (MDM, BYOD inventory). Within 7 days: Deploy Chrome version 149.0.7827.53 or later to all managed Android devices via mobile device management or push update notifications. Within 30 days: Verify update compliance and audit logs for any Chrome versions still below 149.0.7827.53.

Google Chrome CVE-2026-11012

EUVD-2026-34461 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-3gm2-xqpg-6jw8

Denial Of Service Use After Free Memory Corruption Google Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Red Hat

9.0 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 18:24 vuln.today

CVSS changed

Jun 06, 2026 - 18:22 NVD

8.3 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in Serial in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome on Android before 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a use-after-free in the Serial component. Exploitation requires user interaction with a crafted HTML page and a prior renderer compromise, making this a second-stage vulnerability typically chained with another bug. No public exploit identified at time of analysis and EPSS is very low (0.03%), but Google has shipped a patched stable channel build.

Technical ContextAI

The flaw resides in Chrome's Serial implementation, which exposes the Web Serial API for communicating with serial devices from web content. The root cause is CWE-416 (Use After Free): memory referenced by Serial-related objects is freed while still in use, allowing the attacker-controlled renderer process to manipulate freed memory and corrupt object state in a more privileged process. Because Web Serial brokers requests between the renderer (sandboxed) and the browser process (higher privilege), a UAF in this path is a classic sandbox-escape primitive in Chromium's multi-process architecture. The affected component runs on Android builds of Chrome prior to 149.0.7827.53.

RemediationAI

Vendor-released patch: Chrome for Android 149.0.7827.53 or later - update via Google Play Store or enterprise mobile management to deploy the fixed stable channel build per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html). No CVE-specific workaround is documented; as a partial compensating control administrators can disable the Web Serial API through enterprise policy (DefaultSerialGuardSetting=2 or SerialBlockedForUrls) to remove the vulnerable attack surface, with the trade-off that legitimate web-serial device integrations will stop functioning. Restricting users to managed Chrome profiles and blocking installation of untrusted PWAs further reduces the chance of encountering a crafted HTML page that delivers the prerequisite renderer exploit.