What is the CVSS score of CVE-2026-11021?

CVE-2026-11021 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11021?

A critical sandbox escape in Google Chrome for Windows (CVE-2026-11021) could allow attackers who have already compromised the renderer process to gain full access to the host system via a crafted…. A patch is available.

How to fix or mitigate CVE-2026-11021?

Within 24 hours: Enable Chrome auto-update policies and prepare distribution of version 149.0.7827.53 or later across managed Windows systems; confirm update channels are unblocked. Within 7 days: Deploy Chrome 149.0.7827.53 to test environments and verify no compatibility issues with critical web applications. Within 30 days: Confirm Chrome 149.0.7827.53 or later is deployed across all Windows Chrome installations; audit version compliance and block older versions from connecting to corporate networks if technically feasible.

Google Chrome CVE-2026-11021

EUVD-2026-34470 CRITICAL

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-rmq3-3gv6-r724

Information Disclosure Google Microsoft

Critical

Disputed · 9.6 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Red Hat

9.0 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 16:22 vuln.today

CVSS changed

Jun 08, 2026 - 16:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:17 nvd

CRITICAL 9.6

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in GPU in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome on Windows prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page that exploits insufficient input validation in the GPU component. The CVSS 9.6 score reflects the scope change from renderer to host, but real-world exploitation requires chaining with a separate renderer compromise and user interaction. EPSS is low at 0.05% and no public exploit is identified at time of analysis.

Technical ContextAI

The vulnerability resides in Chrome's GPU process, which handles graphics acceleration and inter-process communication with sandboxed renderer processes on Windows. The root cause is CWE-20 (Improper Input Validation), where the GPU process fails to adequately validate messages or data structures coming from the lower-privilege renderer. Chrome's multi-process architecture relies on the GPU process as a higher-privilege broker, so flaws in its IPC validation can be abused as a sandbox-escape primitive. Affected scope is Chrome builds on Windows prior to 149.0.7827.53; other platforms are not enumerated in the available data.

RemediationAI

Update Chrome on Windows to the vendor-released patched version 149.0.7827.53 or later via the Stable channel update referenced at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html; most managed deployments will receive this automatically through Chrome's auto-update mechanism, which should be verified as enabled. For environments where update rollout is delayed, restart Chrome to force the pending update to apply, and audit Group Policy settings that may be suppressing updates. As a temporary compensating control, disabling GPU acceleration via chrome://settings or the --disable-gpu command-line flag reduces exposure to GPU-process bugs but will degrade rendering performance and break hardware-accelerated video; site isolation should be left enabled. Administrators of Chromium-derivative browsers should monitor their respective vendor advisories for downstream respins.