What is the CVSS score of CVE-2026-11046?

CVE-2026-11046 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11046?

Google Chrome versions prior to 149.0.7827.53 contain a sandbox escape vulnerability (CVSS 8.8) affecting all users across Windows, macOS, and Linux.. A patch is available.

How to fix or mitigate CVE-2026-11046?

Within 24 hours: Inventory Chrome installations across endpoints and communicate mandatory update directive. Within 7 days: Deploy Google Chrome 149.0.7827.53 or later using your endpoint management platform with forced restart policies. Within 30 days: Verify deployment success via automated reporting; target 95%+ compliance rate.

Google Chrome CVE-2026-11046

EUVD-2026-34495 HIGH

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-396h-26hj-7m76

Google RCE Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.2 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 03:01 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Insufficient validation of untrusted input in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandboxed arbitrary code execution in Google Chrome prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to run arbitrary code within the Chrome sandbox via a crafted HTML page processed by the Media component. The flaw stems from insufficient validation of untrusted input (CWE-20) and is rated Medium severity by Chromium despite an 8.8 CVSS, reflecting that it serves as a second-stage primitive rather than a standalone RCE; no public exploit identified at time of analysis.

Technical ContextAI

The vulnerability resides in Chrome's Media subsystem, which handles parsing and playback of audio/video content delivered via HTML pages. CWE-20 (Improper Input Validation) indicates that the Media component fails to adequately sanitize or validate fields within crafted media data before processing, enabling memory corruption or unsafe state inside the renderer. Because Chrome's multi-process architecture isolates web content in a sandboxed renderer, this bug alone does not breach the sandbox - instead, it permits an attacker who already controls the renderer (typically via a prior renderer RCE) to execute additional arbitrary code within that sandboxed context, which is useful as a stepping stone in an exploit chain leading toward sandbox escape.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - update Chrome to this version or later via the built-in updater or by restarting the browser after fetching the Stable channel update described at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. For managed fleets, push the updated MSI/PKG/deb via enterprise deployment tooling and verify with chrome://version. Downstream Chromium-based browsers should be updated once their vendors ship the corresponding backport. As compensating controls until patching completes, restrict browsing to trusted sites, disable autoplay and media-rich content where feasible via enterprise policy (AutoplayAllowed=false), or deploy site isolation and renderer sandbox hardening flags; note these reduce usability of media-heavy applications such as video conferencing and streaming and do not fully eliminate the underlying primitive.