What is the CVSS score of CVE-2026-11030?

CVE-2026-11030 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-11030?

Google Chrome prior to version 149.0.7827.53 contains a high-severity remote code execution vulnerability (CVSS 8.8) that could enable attackers to compromise enterprise workstations when users visit…. A patch is available.

How to fix or mitigate CVE-2026-11030?

Within 24 hours: Issue security alert to all employees; identify Chrome deployment scope and prepare version 149.0.7827.53 or later for rollout. Within 7 days: Deploy patch to all systems; prioritize devices handling sensitive data and customer-facing systems. Within 30 days: Verify 100% patch coverage; audit remaining vulnerable instances and ensure automatic update policies are enabled.

Google Chrome CVE-2026-11030

EUVD-2026-34479 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-jj3v-p7gf-2xfj

Denial Of Service Use After Free Memory Corruption Google Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.8 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 20:24 vuln.today

CVSS changed

Jun 05, 2026 - 20:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via malicious network traffic. (Chromium security severity: Medium)

AnalysisAI

Remote heap corruption in Google Chrome prior to 149.0.7827.53 allows attackers to exploit a use-after-free condition in the Network component via crafted network traffic when a user visits or interacts with attacker-controlled content. Rated CVSS 8.8 with a patch available from Google, though EPSS exploitation probability is currently very low (0.03%, 11th percentile) and no public exploit has been identified at time of analysis.

Technical ContextAI

The flaw is a CWE-416 Use-After-Free in Chrome's Network stack, the subsystem that handles HTTP(S), socket, and protocol-level traffic within the Chromium multi-process architecture. Use-after-free bugs occur when memory is freed but a dangling pointer remains accessible, allowing later reads/writes to reference attacker-controllable heap state; in a browser's network code this can be reached by manipulating response sequencing, connection lifecycle, or protocol parsing. Chromium classifies this internally as Medium severity, but the resulting heap corruption is the standard primitive used to chain into renderer or network-process compromise. Affected component is tracked under Chromium issue 497722502.

RemediationAI

Vendor-released patch: upgrade Google Chrome to 149.0.7827.53 or later via the Stable channel update documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html; managed environments should push the update through Chrome Browser Cloud Management, Group Policy, or MDM and force-restart browsers to apply it. Downstream Chromium-based browser users should install the corresponding vendor release once their project rebases on the patched Chromium. Until patching is complete, compensating controls include restricting browsing to trusted destinations via enterprise web filtering, disabling preloading/prefetch features that increase exposure to attacker-controlled connections (at the cost of perceived performance), and enabling Site Isolation and the Network Service sandbox where not already on (negligible side effect). Track the Chromium issue at https://issues.chromium.org/issues/497722502 for additional detail as it becomes public.