What is the CVSS score of CVE-2026-11024?

CVE-2026-11024 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-11024?

A buffer overflow vulnerability in Google Chrome's Skia graphics library (CVE-2026-11024, CVSS 8.8) allows remote attackers to execute arbitrary code within the browser sandbox by delivering…. A patch is available.

How to fix or mitigate CVE-2026-11024?

24 hours: Inventory Chrome versions across all enterprise endpoints to identify affected systems. 7 days: Begin staged deployment of Chrome 149.0.7827.53 starting with pilot groups and high-risk roles. 30 days: Achieve 100% organizational rollout to Chrome 149.0.7827.53; validate compliance through endpoint management tools.

Google Chrome CVE-2026-11024

EUVD-2026-34473 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-06-04 chrome-cve-admin@google.com

GHSA-c5v4-cx2h-x7cm

Buffer Overflow Google Stack Overflow

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Red Hat

8.8 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 15:38 vuln.today

CVSS changed

Jun 08, 2026 - 15:37 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Stack buffer overflow in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit stack corruption via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Stack-based buffer overflow in the Skia graphics library shipped with Google Chrome versions prior to 149.0.7827.53 lets a remote attacker corrupt the renderer process stack by serving a crafted HTML page, with potential for arbitrary code execution within the sandbox. The flaw carries a CVSS 3.1 base score of 8.8 (network vector, user interaction required) and no public exploit identified at time of analysis, while a very low EPSS score of 0.03% (10th percentile) suggests no current mass-exploitation pressure despite the high impact rating.

Technical ContextAI

Skia is the open-source 2D graphics engine that Chromium uses to rasterize HTML, CSS, Canvas, and SVG content for both screen rendering and image decoding. The root cause is CWE-121 (Stack-based Buffer Overflow), meaning a fixed-size stack buffer inside Skia parsing or drawing code is written past its bounds when processing attacker-controlled graphical input, which can overwrite saved return addresses, frame pointers, or adjacent locals. Because Skia is invoked during normal page rendering in the Chrome renderer process, the affected component sits on every browsing path that handles graphical content, and the underlying CPE class is Google Chrome desktop builds prior to 149.0.7827.53.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53; upgrade Chrome immediately via the stable-channel update referenced at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and validate via chrome://settings/help, and consult the upstream Chromium issue at https://issues.chromium.org/issues/497591594 and the VulDB entry at https://vuldb.com/vuln/368652 for additional context. Track and apply equivalent updates for downstream Chromium browsers (Microsoft Edge, Brave, Opera, Vivaldi) and any Electron- or CEF-based applications in your environment, since they ship their own Skia. If patching must be delayed, compensating controls include enforcing Chrome's Site Isolation and renderer sandbox (verify chrome://flags defaults are unchanged), restricting outbound browsing to trusted destinations via web-proxy allowlists or DNS filtering to reduce exposure to crafted HTML pages, and disabling rich previews/auto-fetching of untrusted links in email and chat clients; note that allowlisting can break legitimate workflows and is not a substitute for the patch.