What is the CVSS score of CVE-2026-11028?

CVE-2026-11028 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11028?

Google Chrome's Media component contains a use-after-free vulnerability (CVE-2026-11028, CVSS 8.8) affecting Linux and ChromeOS deployments prior to version 149.0.7827.53.. A patch is available.

How to fix or mitigate CVE-2026-11028?

Within 24 hours: Inventory Chrome and Chromium installations on Linux and ChromeOS systems to identify exposure scope. Within 7 days: Deploy Chrome update to version 149.0.7827.53 or later across all affected systems using standard patch management channels. Within 30 days: Validate patch deployment completeness via vulnerability scanning and establish monitoring for Media component CVEs.

Google Chrome CVE-2026-11028

EUVD-2026-34477 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-vfjh-w97h-2q3f

Google Memory Corruption RCE Use After Free Denial Of Service Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 03:01 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Media in Google Chrome on Linux and ChromeOS prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox-contained arbitrary code execution in Google Chrome's Media component affects Linux and ChromeOS builds prior to 149.0.7827.53, where a use-after-free flaw can be triggered via a crafted HTML page. Exploitation requires that the attacker has already compromised the renderer process, meaning this bug functions as a second-stage primitive in a multi-vulnerability chain rather than a standalone RCE. No public exploit identified at time of analysis, and Chromium rates the internal severity as Medium despite the NVD CVSS of 8.8.

Technical ContextAI

The vulnerability resides in Chrome's Media subsystem, which handles audio/video decoding, MediaStream APIs, and related codec pipelines inside the renderer process. CWE-416 (Use After Free) indicates that memory is freed while a dangling pointer remains reachable; subsequent dereference of that pointer allows attacker-controlled data to be interpreted as a valid object, typically leading to type confusion and control-flow hijack. Because Chrome's Media code historically interacts with multiple threads and reference-counted objects, lifetime bugs here are a recurring source of exploitable primitives. The affected CPE space covers Google Chrome builds prior to 149.0.7827.53 on Linux and ChromeOS, per the EUVD entry EUVD-2026-34477.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 on Linux and ChromeOS - update via Chrome's built-in updater or by relaunching the browser, and confirm the version under chrome://settings/help. For managed fleets, push the update through Google Admin console (ChromeOS) or your enterprise software distribution channel, referencing the advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. No supported workaround exists short of patching; as a compensating control until rollout completes, enterprises can enforce Site Isolation (already default), restrict installation of untrusted extensions that increase renderer attack surface, and consider tightening the SitePerProcess and IsolateOrigins policies, accepting modest memory overhead in exchange for stronger process boundaries.