What is the CVSS score of CVE-2026-11057?

CVE-2026-11057 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11057?

Yes, a patch is available for CVE-2026-11057. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11057

EUVD-2026-34505 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-06-04 chrome-cve-admin@google.com

GHSA-94f5-636p-gpjc

Information Disclosure Google Chrome

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

4.8 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 20:47 vuln.today

CVSS changed

Jun 05, 2026 - 20:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Uninitialized memory use in Skia, Chrome's 2D graphics library, exposes process memory contents to a remote attacker who has already compromised the renderer process. Affected versions are all Chrome releases prior to 149.0.7827.53 on desktop platforms. An attacker leveraging this flaw can read potentially sensitive data from process memory - such as credentials, tokens, or page content - by delivering a crafted HTML page that triggers Skia's uninitialized memory path. No public exploit identified at time of analysis and EPSS stands at 0.03% (11th percentile), indicating low current exploitation pressure; however, the confidentiality impact is rated High by NVD.

Technical ContextAI

Skia is the open-source 2D graphics rendering library embedded in Google Chrome and Chromium-based browsers. CWE-457 (Use of Uninitialized Variable) describes the root cause: memory allocated for a graphics operation is accessed before being initialized, meaning it may retain arbitrary residual data from prior heap or stack usage. Within Chrome's multi-process architecture, the renderer process handles HTML parsing and graphical composition - a compromised renderer can directly invoke Skia rendering paths. The affected component is identified in EUVD as Chrome versions in the range below 149.0.7827.53. Because Skia is shared infrastructure across Chromium-based products, downstream forks may also be affected pending their own update cycles.

RemediationAI

Update Google Chrome to version 149.0.7827.53 or later - this is the vendor-released patch confirmed in the stable channel update advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism will deploy this automatically for most users; enterprise administrators should push the update via policy and verify the installed version via chrome://settings/help. For environments where immediate patching is not feasible, consider restricting access to untrusted or external web content using URL filtering or browser isolation solutions, though these controls do not eliminate the underlying flaw and carry usability trade-offs. Chromium-based browser vendors should track the upstream Chromium issue at https://issues.chromium.org/issues/498951946 for the corresponding patch commit.