What is the CVSS score of CVE-2026-11049?

CVE-2026-11049 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11049?

A high-severity remote code execution vulnerability in Google Chrome's Password Manager (CVE-2026-11049, CVSS 8.8) allows attackers to execute arbitrary code by luring users to malicious web pages.. A patch is available.

How to fix or mitigate CVE-2026-11049?

Within 24 hours: Issue security alert to all users regarding the Chrome Password Manager vulnerability and advise caution with untrusted links. Within 7 days: Deploy Chrome update to version 149.0.7827.53 or later organization-wide using MDM/device management tools. Within 30 days: Verify patch deployment completion across all endpoints and review credential access logs for anomalies during the pre-patch window.

Google Chrome CVE-2026-11049

EUVD-2026-34498 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-r2vm-42vv-hrcm

Google Memory Corruption RCE Use After Free Denial Of Service Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 03:02 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome's Password Manager component (versions prior to 149.0.7827.53) allows a remote attacker to execute arbitrary code within the renderer sandbox by luring a victim to a crafted HTML page. The flaw stems from a use-after-free memory corruption condition (CWE-416) and carries a CVSS 3.1 score of 8.8. No public exploit identified at time of analysis, but a vendor patch has been released by Google.

Technical ContextAI

The vulnerability resides in the Password Manager subsystem of Chromium, the open-source browser engine that underpins Google Chrome and many derivative browsers (Edge, Brave, Opera, Vivaldi). CWE-416 (Use After Free) describes a memory safety violation in which the program continues to reference heap memory after it has been freed, enabling an attacker to coerce the allocator into reusing that slot with attacker-controlled data and ultimately hijack control flow. Password Manager is a privileged-feeling but renderer-resident feature that processes form data and credential metadata from web pages, making it an attractive surface for crafted-HTML triggers. Successful exploitation per Google's note is bounded by the Chromium sandbox, so attackers gain code execution inside the renderer rather than full host compromise - but renderer RCE is the standard first stage paired with a separate sandbox-escape chain.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 or later - update via the built-in Chrome updater (chrome://settings/help) or via managed-deployment tooling such as Chrome Browser Cloud Management, Intune, Jamf, or GPO. Enterprise administrators should verify rollout completion across the fleet and force-restart browsers after update, since the fix only loads after a restart. For Chromium-derivative browsers (Edge, Brave, Opera, Vivaldi, Electron apps) monitor each vendor's advisory and update once they incorporate the upstream Chromium fix. If patching must be delayed, compensating controls include disabling Chrome's built-in Password Manager via the PasswordManagerEnabled=false enterprise policy (trade-off: users lose autofill and may move credentials to less-managed tools), restricting browsing to a curated allowlist via SafeSites / URL filtering at the proxy (trade-off: significant productivity impact), or enforcing Site Isolation and strict process-per-site (already default but worth verifying). Reference the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html.