What is the CVSS score of CVE-2026-11047?

CVE-2026-11047 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11047?

Google Chrome for Windows prior to version 149.0.7827.53 contains a sandbox escape vulnerability (CVE-2026-11047, CVSS 9.6) that could allow attackers to break out of the browser process and access…. A patch is available.

How to fix or mitigate CVE-2026-11047?

Within 24 hours: Identify Windows systems running Chrome and verify whether auto-update is enabled or if manual patch deployment is required. Within 7 days: Deploy Chrome 149.0.7827.53 or later across all Windows environments; confirm auto-update settings are active for consumer devices and enforce deployment via device management for enterprise systems. Within 30 days: Complete patch compliance verification and audit Chrome version inventory to confirm no systems remain below 149.0.7827.53.

Google Chrome CVE-2026-11047

EUVD-2026-34496 CRITICAL

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-xfq2-ggp9-9j86

Information Disclosure Google Microsoft

Critical

Disputed · 9.6 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

8.2 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 20:26 vuln.today

CVSS changed

Jun 05, 2026 - 20:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:17 nvd

CRITICAL 9.6

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Base in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome on Windows prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. The flaw resides in the Base component and is rated Medium severity by Chromium despite the CVSS 9.6 score, reflecting the prerequisite of a prior renderer compromise. No public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.05%.

Technical ContextAI

The vulnerability is in Chrome's Base component, a foundational library providing core utilities shared across the browser. The CWE-20 (Improper Input Validation) classification indicates inadequate validation of data crossing the renderer-to-browser process boundary, which is the trust boundary enforced by Chrome's multi-process sandbox architecture. On Windows, Chrome relies on the OS token restrictions and job objects combined with broker-mediated IPC; a flaw in Base input handling can let a compromised renderer pass malformed data that the higher-privileged browser process mishandles, breaking the sandbox isolation that normally contains web-origin code.

RemediationAI

Upgrade Chrome on Windows to 149.0.7827.53 or later - this is the vendor-released patch identified in the Chrome Releases advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Most installations will receive this automatically via Chrome's background updater; confirm by navigating to chrome://settings/help and verifying the version, and force a restart on long-running sessions where the update has been downloaded but not applied. As a compensating control until patching, enable Site Isolation (default on desktop but worth verifying with chrome://flags), restrict execution of untrusted browser extensions which can broaden renderer attack surface, and consider deploying Chrome's Enterprise policies to enforce auto-update; aggressive workarounds like disabling JavaScript are impractical for general browsing. Track Chromium-based browsers (Edge, Brave, Opera) for their corresponding security releases.