What is the CVSS score of CVE-2026-11041?

CVE-2026-11041 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-11041?

Google Chrome on Windows contains a sandbox escape vulnerability (CVSS 8.8) affecting versions prior to 149.0.7827.53 that could allow attackers with prior renderer process compromise to bypass…. A patch is available.

How to fix or mitigate CVE-2026-11041?

Within 24 hours: Audit Chrome deployment scale and update frequency capabilities across Windows infrastructure. Within 7 days: Deploy Chrome 149.0.7827.53 or later to all Windows endpoints using auto-update mechanisms or MDM enforcement. Within 30 days: Verify 100% patch compliance via endpoint inventory tools and monitor security advisories for additional renderer-process vulnerabilities that could chain with this flaw.

Google Chrome CVE-2026-11041

EUVD-2026-34490 HIGH

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-rjg4-xpmp-4c93

Information Disclosure Google Microsoft

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.2 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 20:34 vuln.today

CVSS changed

Jun 05, 2026 - 18:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome on Windows prior to 149.0.7827.53 enables a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page that exploits insufficient input validation in the Media component. The flaw requires user interaction (visiting a malicious page) and a prior renderer compromise, making it a second-stage capability typically chained with another bug; no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.05%.

Technical ContextAI

The vulnerability resides in Chrome's Media subsystem, which handles audio/video decoding, MediaStream APIs, and related codecs within the renderer process and brokers privileged operations to the browser process. The root cause is CWE-20 (Improper Input Validation), meaning data crossing the renderer-to-browser IPC boundary in the Media stack is not adequately validated, allowing a malicious renderer to coerce the higher-privileged browser process into performing actions that effectively bypass the Chromium sandbox. On Windows specifically, the sandbox relies on restricted process tokens and job objects, so a successful escape elevates the attacker from the locked-down renderer to the broader privileges of the browser process. The affected build is Chromium-based Chrome stable channel on Windows prior to 149.0.7827.53.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 or later on Windows - update via Chrome's built-in updater (chrome://settings/help) or push the update through enterprise management (Chrome Browser Cloud Management, Group Policy, or SCCM/Intune) as described in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Track the upstream issue at https://issues.chromium.org/issues/498700369 for technical details once Google lifts the restricted-view embargo. For Chromium-derivative browsers (Edge, Brave, Opera, Vivaldi) on Windows, apply the corresponding rebased build as soon as the vendor publishes it. As compensating controls until patching completes, enterprises can enforce Site Isolation (already default), disable autoplay and restrict media permissions via the AutoplayAllowed and DefaultMediaStreamSetting Chrome policies to reduce the Media attack surface (trade-off: breaks legitimate video/voice apps), and deploy an EDR rule alerting on unusual child-process spawns from chrome.exe to catch post-escape activity.