What is the CVSS score of CVE-2026-11040?

CVE-2026-11040 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-11040?

Google Chrome prior to version 149.0.7827.53 contains a critical sandbox escape vulnerability (CVE-2026-11040) that could allow attackers to compromise systems when users visit malicious websites on…. A patch is available.

How to fix or mitigate CVE-2026-11040?

Within 24 hours: Conduct inventory of Chrome versions across all managed systems. Within 7 days: Deploy Chrome 149.0.7827.53 or later through enterprise software management. Within 30 days: Confirm 100% deployment completion and restrict user ability to downgrade.

Google Chrome CVE-2026-11040

EUVD-2026-34489 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-mm6g-9f9f-2m6q

Denial Of Service Use After Free Memory Corruption Google Red Hat Suse Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 17:23 vuln.today

CVSS changed

Jun 05, 2026 - 17:22 NVD

8.3 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome's ANGLE graphics layer prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. The flaw is a use-after-free (CWE-416) requiring user interaction to visit the malicious page, and no public exploit has been identified at time of analysis despite an EPSS score of 0.03% indicating very low near-term exploitation probability.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chromium's translation layer that converts OpenGL ES API calls into the host platform's native graphics API (Direct3D on Windows, Metal on macOS, Vulkan/OpenGL on Linux), enabling consistent WebGL and GPU-accelerated rendering across operating systems. Because ANGLE code executes within Chrome's GPU process, which historically has a weaker sandbox than the renderer to allow hardware access, memory corruption here is a prime target for sandbox-escape chains. The underlying weakness is CWE-416 (Use After Free), where memory is referenced after being freed - in graphics code this typically arises from object lifetime mismanagement across shader, buffer, or texture objects, allowing an attacker who controls the freed allocation to hijack control flow or corrupt critical state.

RemediationAI

Apply the vendor-released patch by upgrading Chrome to version 149.0.7827.53 or later via the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html; in most enterprise environments this happens automatically via Chrome's built-in updater and can be enforced through Group Policy (Windows) or MDM profiles (macOS) by mandating a minimum browser version. For downstream Chromium-based browsers, monitor their respective release channels for updates that pull in the ANGLE fix. As a compensating control while patching is staged, consider disabling hardware-accelerated WebGL via the chrome://flags or the HardwareAccelerationModeEnabled enterprise policy to reduce ANGLE attack surface - note this degrades performance for 3D/canvas-heavy web apps and breaks WebGL-dependent sites. Site isolation (enabled by default in modern Chrome) and restricting browsing to trusted sites further limits exposure since renderer compromise is a prerequisite.