What is the CVSS score of CVE-2026-11054?

CVE-2026-11054 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11054?

Google Chrome versions before 149.0.7827.53 contain a remote code execution vulnerability exploitable when users visit a malicious webpage.. A patch is available.

How to fix or mitigate CVE-2026-11054?

Within 24 hours: Audit Chrome deployment across endpoints and confirm update mechanism readiness. Within 7 days: Deploy Google Chrome 149.0.7827.53 or later to all organization-managed instances using your patch management system. Within 30 days: Verify 100% deployment compliance and document upgrade in change log.

Google Chrome CVE-2026-11054

EUVD-2026-34502 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-q226-3ph8-px6r

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 03:03 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome versions prior to 149.0.7827.53 allows a remote attacker to execute arbitrary code inside the renderer sandbox by enticing a victim to visit a crafted HTML page that triggers a use-after-free condition in the WebRTC component. No public exploit identified at time of analysis, though the high CVSS score of 8.8 and the memory corruption class make this a priority browser patch. Chromium rates the security severity as Medium despite the CVSS score, suggesting sandbox containment limits real-world impact.

Technical ContextAI

WebRTC (Web Real-Time Communication) is the browser subsystem that enables peer-to-peer audio, video, and data exchange directly between browsers without plugins, implemented in Chrome via a complex C++ stack handling SDP negotiation, ICE candidates, DTLS-SRTP media, and data channels. The vulnerability is a CWE-416 Use-After-Free, a memory safety bug where freed heap memory is still referenced and reused, typically leading to controlled object replacement and arbitrary code execution via vtable hijacking or function pointer overwrite. The affected product per EUVD data is Chrome at versions below 149.0.7827.53 on the Stable Desktop channel, with the bug tracked in Chromium issue 498845284.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - upgrade immediately via Chrome's built-in updater (chrome://settings/help) or push the update through enterprise management (Chrome Browser Cloud Management, Group Policy, Jamf, Intune); restart the browser after installation since updates do not apply until relaunch. Reference the Chrome Releases blog at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and the Chromium bug at https://issues.chromium.org/issues/498845284 for advisory details, and validate downstream Chromium-based browsers (Edge, Brave, Electron apps) have absorbed the fix. If patching must be delayed, a targeted compensating control is to disable WebRTC functionality via enterprise policy (URLBlocklist for WebRTC, or the WebRtcUdpPortRange/WebRtcAllowLegacyTLSProtocols policies set restrictively) - this breaks video conferencing in Meet, Teams web, Zoom web, and similar apps, so coordinate with users; broader controls like restricting browsing to trusted sites via SafeSites or a forward proxy reduce exposure but are not a substitute for the patch.