What is the CVSS score of CVE-2026-11056?

CVE-2026-11056 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11056?

Google Chrome on Windows prior to version 149.0.7827.53 is vulnerable to sandbox escape attacks that could allow full system compromise when combined with prior renderer-process compromise.. A patch is available.

How to fix or mitigate CVE-2026-11056?

Within 24 hours: Identify all Chrome installations on Windows systems and prepare patching procedures. Within 7 days: Deploy Chrome 149.0.7827.53 or later to all Windows endpoints, prioritizing high-risk systems. Within 30 days: Verify 100% patch compliance and audit for any renderer-process exploitation indicators.

Google Chrome CVE-2026-11056

EUVD-2026-34504 CRITICAL

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-w7hc-w7v9-336m

Information Disclosure Google Microsoft

Critical

Disputed · 9.6 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 19:23 vuln.today

CVSS changed

Jun 05, 2026 - 19:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:17 nvd

CRITICAL 9.6

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in SiteIsolation in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome on Windows prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the Site Isolation sandbox via a crafted HTML page. The flaw stems from insufficient validation of untrusted input in the Site Isolation component (CWE-20) and is rated CVSS 9.6 due to scope change, though Chromium itself classifies the underlying severity as Medium. No public exploit has been identified at time of analysis and EPSS is very low (0.05%, 15th percentile), but the chained-exploit potential makes it a meaningful browser-security risk.

Technical ContextAI

Site Isolation is Chrome's defense-in-depth architecture that places each web site into its own dedicated renderer process so that a compromised renderer cannot read cross-origin data or escape into the more privileged browser process. This issue is rooted in CWE-20 (Improper Input Validation): data crossing the renderer/browser trust boundary inside the Site Isolation enforcement path is not sufficiently validated, allowing a renderer that has already been hijacked (typically via a separate memory-corruption bug in V8 or Blink) to influence browser-side logic and achieve a sandbox escape. The affected component is the Chromium browser binary on Windows builds prior to 149.0.7827.53, with no CPE data provided in the input.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 or later on Windows - update via Chrome's built-in updater (chrome://settings/help) or by redeploying the Chrome MSI through enterprise management tooling, then restart the browser to apply. Administrators managing fleets should consult the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and the Chromium tracker at https://issues.chromium.org/issues/498887785. As a compensating control until patching, restrict browsing to trusted destinations via enterprise URL allowlists (trade-off: breaks general web access), enforce strict site engagement / extension policies, and ensure Windows process mitigations (CFG, ACG) are not disabled; disabling Site Isolation is NOT a viable workaround because it would weaken, not strengthen, the boundary this CVE concerns.