What is the CVSS score of CVE-2026-11029?

CVE-2026-11029 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11029?

Google Chrome on Android versions before 149.0.7827.53 contain a critical sandbox escape vulnerability (CVE-2026-11029) that could allow an attacker with prior renderer process compromise to escalate…. A patch is available.

How to fix or mitigate CVE-2026-11029?

Within 24 hours: Inventory all managed Android devices running Chrome and document current versions. Within 7 days: Deploy Chrome version 149.0.7827.53 or later via MDM or app store enforcement to all affected devices. Within 30 days: Verify 100% deployment completion through device compliance reports and document remediation status for audit purposes.

Google Chrome CVE-2026-11029

EUVD-2026-34478 CRITICAL

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-hmcf-3mjw-5jmc

Information Disclosure Google Red Hat Suse

Critical

Disputed · 9.6 NVD

Severity by source

Sources disagree (Medium–Critical)

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Red Hat

9.0 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 12:37 vuln.today

CVSS changed

Jun 10, 2026 - 12:37 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:17 nvd

CRITICAL 9.6

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in Drag and Drop in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome on Android before 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page exploiting the Drag and Drop component. The flaw carries a CVSS 9.6 due to scope change, but no public exploit identified at time of analysis and EPSS is very low (0.05%, 15th percentile), indicating limited near-term exploitation likelihood. Google rates the underlying Chromium severity as Medium despite the high CVSS.

Technical ContextAI

The vulnerability lives in Chrome's Drag and Drop implementation on the Android platform, which handles untrusted DOM input transferred between origins or between renderer and browser process boundaries. Rooted in CWE-20 (Improper Input Validation), insufficient sanitization of attacker-controlled drag payloads allows logic in a privileged context to act on malformed data originating from a compromised renderer. Because Chrome's multi-process model relies on the renderer being untrusted and the browser process enforcing the sandbox boundary, a validation failure on data crossing that boundary can be chained to escape the renderer sandbox. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* limited to the Android build prior to 149.0.7827.53.

RemediationAI

Vendor-released patch: Google Chrome for Android 149.0.7827.53 - upgrade via Google Play or the Chrome auto-update channel as soon as practical, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. No vendor-documented workaround exists, but because the bug is exploitable only after a separate renderer compromise, compensating controls include enabling Site Isolation (default on Android Chrome on supported devices), restricting browsing to trusted origins via MDM URL allowlists on managed fleets (trade-off: breaks user web access to arbitrary sites), and disabling drag-and-drop interactions where MDM policy permits (trade-off: degraded usability for productivity sites). Cross-reference the Chromium issue at https://issues.chromium.org/issues/497651688 once it is unrestricted for additional technical detail.