What is the CVSS score of CVE-2026-11043?

CVE-2026-11043 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11043?

Google Chrome on macOS contains a critical sandbox escape vulnerability (CVE-2026-11043) in versions prior to 149.0.7827.53 that could allow attackers with prior renderer process compromise to…. A patch is available.

How to fix or mitigate CVE-2026-11043?

Within 24 hours: identify all macOS systems running Chrome and current version distribution. Within 7 days: deploy Chrome 149.0.7827.53 to all affected macOS systems via MDM or patch management. Within 30 days: verify 100% patch deployment and confirm retirement of all Chrome versions prior to 149.0.7827.53.

Google Chrome CVE-2026-11043

EUVD-2026-34492 CRITICAL

Out-of-bounds Write (CWE-787)

2026-06-04 chrome-cve-admin@google.com

GHSA-gvr2-h97m-hwr5

Google Memory Corruption Buffer Overflow Chrome

Critical

Disputed · 9.6 NVD

Severity by source

Sources disagree (Medium–Critical)

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 20:25 vuln.today

CVSS changed

Jun 05, 2026 - 20:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:17 nvd

CRITICAL 9.6

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Out of bounds write in ANGLE in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome on macOS prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via an out-of-bounds write in ANGLE triggered by a crafted HTML page. The flaw carries a high CVSS of 9.6 due to scope change and full CIA impact, though no public exploit has been identified and EPSS exploitation probability remains very low at 0.03%.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chromium's cross-platform graphics abstraction layer that translates OpenGL ES API calls into the host platform's native graphics API - on macOS this means translation to Metal or OpenGL. The root cause is CWE-787 (Out-of-bounds Write), a memory-corruption class where code writes past the bounds of an allocated buffer, typically due to missing or incorrect length validation in parsing or rendering paths. Because ANGLE runs in the GPU process (a more privileged context than the renderer sandbox), a memory-corruption bug there is a classic stepping stone from a renderer-process compromise to a sandbox escape on macOS specifically.

RemediationAI

Vendor-released patch: Chrome 149.0.7827.53 for macOS - update Chrome via Help > About Google Chrome or rely on the auto-update channel, and confirm via the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. In managed Mac fleets, push the updated build through MDM (Jamf, Intune, Kandji) and verify version compliance. No vendor workaround is documented; as a compensating control until patching, you can reduce the attack surface of the chained renderer-bug-plus-sandbox-escape by disabling hardware acceleration in chrome://settings (which forces software rendering and bypasses much of ANGLE's GPU-process code), with the trade-off of degraded performance for video, WebGL, and Canvas-heavy sites.