What is the CVSS score of CVE-2026-11015?

CVE-2026-11015 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-11015?

Google Chrome's WebGPU component contains an out-of-bounds memory read vulnerability (CVE-2026-11015) that allows remote attackers to disclose sensitive system memory through malicious web pages.. A patch is available.

How to fix or mitigate CVE-2026-11015?

Within 24 hours: Document Chrome deployment scope across the organization and identify systems processing sensitive data. Within 7 days: Deploy Google Chrome version 149.0.7827.53 or later enterprise-wide; enable automatic updates if not already configured. Within 30 days: Verify patch deployment completion across all endpoints and implement monitoring for unusual memory access patterns.

Google Chrome CVE-2026-11015

EUVD-2026-34464 HIGH

Out-of-bounds Read (CWE-125)

2026-06-04 chrome-cve-admin@google.com

GHSA-h2vc-w786-h685

Information Disclosure Google Buffer Overflow Chrome Red Hat Suse

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Red Hat

7.1 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 18:30 vuln.today

CVSS changed

Jun 08, 2026 - 16:22 NVD

8.1 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.1

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Out of bounds read in WebGPU in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Out-of-bounds memory read in the WebGPU component of Google Chrome before 149.0.7827.53 allows a remote attacker to read memory outside intended buffer boundaries when a victim visits a crafted HTML page. The flaw carries a CVSS 8.1 score due to network reachability and high confidentiality/availability impact, but EPSS sits at 0.03% and SSVC reports no observed exploitation, so the practical risk is currently low despite the high CVSS. No public exploit identified at time of analysis.

Technical ContextAI

WebGPU is Chrome's modern GPU API (successor to WebGL) that exposes lower-level access to the host GPU for rendering and compute workloads via JavaScript running in the renderer process. The root cause is CWE-125 (Out-of-bounds Read), a memory safety class where the implementation reads past the end of an allocated buffer - typically due to missing bounds validation on attacker-influenced indices, sizes, or descriptors passed into the WebGPU command pipeline. Because WebGPU command buffers and shader inputs are derived from untrusted page content, malformed structures can steer reads beyond allocated GPU/CPU buffers in the renderer, potentially leaking adjacent memory contents. Affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* across desktop builds prior to the stable channel update.

RemediationAI

Vendor-released patch: update Google Chrome to 149.0.7827.53 or later on the Stable channel per the advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Restart the browser after update to ensure the patched renderer binary is loaded, and for managed fleets push the update via enterprise update channels (Chrome Browser Cloud Management, Group Policy, MDM) and verify chrome://version reflects the fixed build. Users of Chromium-derived browsers should apply the equivalent vendor release once it incorporates the upstream fix referenced in https://issues.chromium.org/issues/497183443. As a temporary compensating control until patched, WebGPU can be disabled by launching Chrome with --disable-features=WebGPU or via the chrome://flags 'Unsafe WebGPU Support' toggle / enterprise policy - trade-off is loss of WebGPU-accelerated rendering and compute for sites that depend on it (some games, ML demos, design tools).