What is the CVSS score of CVE-2026-11050?

CVE-2026-11050 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11050?

Google Chrome's V8 JavaScript engine contains a remote code execution vulnerability (CVSS 8.8) that allows arbitrary code execution when users visit malicious webpages.. A patch is available.

How to fix or mitigate CVE-2026-11050?

Within 24 hours: Identify all Chrome deployments and user population; issue mandatory patch notification to stakeholders. Within 7 days: Deploy Chrome version 149.0.7827.53 or later to all endpoints using your software distribution mechanism (Microsoft Update, MDM, or manual deployment channels). Within 30 days: Verify 100% patch compliance through endpoint management tools and remediate any non-compliant systems.

Google Chrome CVE-2026-11050

EUVD-2026-34499 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-vj5g-wxg8-fm4h

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 03:02 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome's V8 JavaScript engine before version 149.0.7827.53 allows a remote attacker to execute arbitrary code within the renderer sandbox when a victim visits a crafted HTML page. The flaw is a use-after-free memory corruption issue rated CVSS 8.8 (High), and while no public exploit has been identified at time of analysis, V8 bugs of this class are historically high-value targets for exploit chains. SSVC indicates no observed exploitation, but technical impact is total within the sandbox boundary.

Technical ContextAI

The vulnerability resides in V8, Chrome's open-source JavaScript and WebAssembly engine, which compiles and executes untrusted script from arbitrary web pages. CWE-416 (Use After Free) means the engine continues to reference a memory object after it has been freed, allowing an attacker to manipulate the dangling pointer to corrupt memory and steer control flow. In V8 specifically, such bugs typically arise from incorrect lifetime management of garbage-collected objects, type-confusion-adjacent flaws in the TurboFan/Maglev JIT compilers, or improper handling of objects across optimizations and deoptimizations. Successful exploitation yields arbitrary code execution inside the Chrome renderer process, which is constrained by Chrome's site-isolation sandbox - a separate sandbox-escape bug would still be required for full host compromise.

RemediationAI

Vendor-released patch: update Google Chrome to 149.0.7827.53 or later via the built-in updater (chrome://settings/help) and restart the browser to apply, as announced in the Chrome stable channel update at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Enterprises managing Chrome via group policy, Jamf, Intune, or MDM should push the updated MSI/PKG and verify the version through their inventory tooling, and users of Chromium-based browsers (Edge, Brave, Opera, Vivaldi) should apply the equivalent vendor update as soon as those projects rebase on the patched V8. As a compensating control until patched, enable Chrome's Site Isolation (default-on) and consider enabling the optional v8-sandbox / disable-javascript-jit policies which trade some web app performance and compatibility for a smaller V8 attack surface; restricting browsing to known-good sites via DNS/web filtering also reduces exposure to crafted HTML pages at the cost of user friction.