What is the CVSS score of CVE-2026-11052?

CVE-2026-11052 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11052?

Google Chrome on Windows versions prior to 149.0.7827.53 contains a critical sandbox escape vulnerability (CVSS 9.6) that allows attackers with a compromised browser renderer to escalate to…. A patch is available.

How to fix or mitigate CVE-2026-11052?

Within 24 hours: Audit Chrome deployment across Windows endpoints; prioritize systems accessing sensitive data or in critical roles. Within 7 days: Deploy Chrome version 149.0.7827.53 or later through staged rollout; test for application compatibility. Within 30 days: Verify full remediation across all Windows Chrome installations via endpoint monitoring; document non-compliant systems for exception review.

Google Chrome CVE-2026-11052

EUVD-2026-34501 CRITICAL

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-06-04 chrome-cve-admin@google.com

GHSA-qq27-p894-wh76

Information Disclosure Google Memory Corruption Microsoft

Critical

Disputed · 9.6 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 19:23 vuln.today

CVSS changed

Jun 05, 2026 - 19:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:17 nvd

CRITICAL 9.6

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Type Confusion in GPU in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome on Windows versions prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page that triggers a type confusion in the GPU process. The CVSS score of 9.6 reflects the scope-changing nature of escaping the sandbox boundary, though exploitation requires user interaction (visiting a malicious page) and a pre-existing renderer compromise. No public exploit identified at time of analysis, and EPSS is low at 0.03%.

Technical ContextAI

The vulnerability is a CWE-843 (Access of Resource Using Incompatible Type, aka Type Confusion) flaw in Chrome's GPU process, which handles graphics acceleration and runs at a higher privilege boundary than the sandboxed renderer. Chrome's multi-process architecture isolates web content in a low-privilege renderer that communicates with the GPU process via IPC; a type confusion here means the GPU process interprets an object as the wrong type, enabling memory corruption that can be leveraged to execute code outside the renderer sandbox. The affected component is the Windows build of Chrome's Chromium engine prior to 149.0.7827.53.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 for Windows - update via Chrome's built-in updater (chrome://settings/help) or through enterprise management tooling such as Group Policy, Chrome Browser Cloud Management, or Microsoft Intune to force the Stable channel update, per https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chromium-based browsers (Edge, Brave, Opera, Vivaldi) typically receive a corresponding update shortly after; verify each vendor's release notes before assuming coverage. No standalone workaround targets the GPU type confusion itself, but because exploitation requires a prior renderer compromise, compensating controls include disabling hardware acceleration in chrome://settings (which reduces GPU process attack surface at the cost of degraded video/canvas performance) and enforcing Site Isolation plus strict SafeBrowsing policies via Chrome Enterprise policy to lower the probability of the renderer-stage compromise that this bug chains from.