What is the CVSS score of CVE-2026-11055?

CVE-2026-11055 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11055?

Google Chrome on Windows is vulnerable to remote code execution that could expose users to system compromise through routine web browsing, with no public exploit identified at time of analysis.. A patch is available.

How to fix or mitigate CVE-2026-11055?

Within 24 hours: Identify all Chrome users on Windows systems and communicate urgent update requirement. Within 7 days: Verify all Windows-based Chrome installations have been updated to version 149.0.7827.53 or later; enforce automated updates where possible. Within 30 days: Conduct audit to ensure patch compliance across all systems and establish monitoring for new Chrome security advisories.

Google Chrome CVE-2026-11055

EUVD-2026-34503 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-9853-cw3r-5w4v

Google Memory Corruption RCE Use After Free Microsoft Denial Of Service Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 03:03 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome on Windows prior to 149.0.7827.53 allows attackers to run arbitrary code inside the renderer sandbox by luring a user to a crafted HTML page that triggers a use-after-free in the ANGLE graphics layer. The flaw carries a CVSS 8.8 score and requires user interaction (visiting a malicious page), and no public exploit identified at time of analysis. The sandbox containment limits direct system impact, but the bug is a strong candidate for chaining with a sandbox escape.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's translation layer that maps WebGL and other GPU API calls onto the host platform's native graphics stack - on Windows, primarily Direct3D. Because ANGLE processes attacker-controlled GPU command streams in the GPU/renderer process, memory-safety bugs in this layer are a recurring source of high-severity Chromium issues. The root cause class is CWE-416 (Use After Free): an object is freed but a dangling reference is later dereferenced, allowing an attacker who controls heap layout via crafted WebGL/HTML content to coerce the freed slot into a controllable type and achieve code execution inside the sandboxed process. The Windows-only scoping reflects ANGLE's platform-specific D3D backend code path.

RemediationAI

Update Chrome on Windows to version 149.0.7827.53 or later via the Chrome Releases stable channel update referenced at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html; this is the patch available from the vendor. In managed environments, push the update through Google Update / Chrome Browser Cloud Management and verify clients have restarted Chrome so the new binary is loaded. For Chromium-based browsers (Edge, Brave, Opera), apply their respective vendor updates as they pick up the ANGLE fix. If patching must be delayed, compensating controls include disabling hardware-accelerated WebGL via the chrome://flags or enterprise policy 'HardwareAccelerationModeEnabled=false' (trade-off: degrades WebGL/Canvas/video performance and breaks GPU-dependent web apps), and blocking access to untrusted sites via web filtering (trade-off: only effective against known-bad domains, not watering-hole attacks on compromised legitimate sites). Tracking bug https://issues.chromium.org/issues/498881735 will likely become public after the patch window closes.