What is the CVSS score of CVE-2026-11033?

CVE-2026-11033 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11033?

Yes, a patch is available for CVE-2026-11033. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11033

EUVD-2026-34482 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-06-04 chrome-cve-admin@google.com

GHSA-r34r-5rvh-pc3m

Information Disclosure Google

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 19:29 vuln.today

CVSS changed

Jun 05, 2026 - 19:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Uninitialized Use in WebML in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Uninitialized memory read in Chrome's WebML component on macOS exposes potentially sensitive process memory contents to remote attackers. Affected are all Chrome versions prior to 149.0.7827.53 on Mac; exploitation requires convincing a user to visit a specially crafted HTML page. No public exploit code or active exploitation (CISA KEV) has been identified, and the EPSS score of 0.03% (10th percentile) reflects low real-world exploitation likelihood at time of analysis.

Technical ContextAI

CWE-457 (Use of Uninitialized Variable) describes a class of memory-safety bug where a variable is read before being assigned a defined value, allowing residual heap or stack contents to be exposed. The affected component is WebML, Chrome's on-device machine learning inference subsystem used to accelerate browser-embedded AI tasks. Because WebML processes attacker-influenced web content (HTML/JS), a crafted page can trigger a code path that reads an uninitialized buffer and potentially surfaces sensitive data - such as prior memory allocations from the same process - back to the attacker via a side channel or direct return value. The vulnerability is scoped to the macOS platform, suggesting a platform-specific allocation or alignment behavior that diverges from Windows/Linux builds. Affected versions are all Chrome releases below 149.0.7827.53 on Mac, per ENISA EUVD-2026-34482.

RemediationAI

Update Google Chrome on macOS to version 149.0.7827.53 or later; this is the vendor-released patch confirmed in the stable channel advisory at chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism should deliver this update automatically, but administrators managing enterprise fleets should verify deployment via policy or MDM. As a compensating control pending update, disabling or restricting access to pages that invoke WebML inference (e.g., AI-driven browser features) may reduce exposure, though this is operationally disruptive and not a substitute for patching. Site Isolation (already on by default in Chrome) limits cross-origin memory leakage scope but does not eliminate the intra-process memory disclosure risk.