What is the CVSS score of CVE-2026-11058?

CVE-2026-11058 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11058?

Google Chrome users on Windows are vulnerable to a privilege escalation attack that could allow attackers to gain full system access following an initial browser compromise.. A patch is available.

How to fix or mitigate CVE-2026-11058?

Within 24 hours: Audit Chrome deployment method and update mechanisms across Windows endpoints. Within 7 days: Force deployment of Chrome version 149.0.7827.53 or later to all Windows systems via Group Policy, MDM, or managed update channels. Within 30 days: Verify 100% compliance through inventory tools and address any machines on older versions.

Google Chrome CVE-2026-11058

EUVD-2026-34506 HIGH

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-06-04 chrome-cve-admin@google.com

GHSA-9r7g-8qc7-fmh5

Privilege Escalation Google Microsoft

7.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.2 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 03:04 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

7.5 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 7.5

DescriptionCVE.org

Integer overflow in CredentialProvider in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perform OS-level privilege escalation via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Privilege escalation in Google Chrome on Windows prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via an integer overflow in the CredentialProvider component. Exploitation requires user interaction with a crafted HTML page and a prior renderer compromise, and no public exploit has been identified at time of analysis. Chromium rates the security severity as Medium despite the CVSS 7.5 score.

Technical ContextAI

The flaw resides in Chrome's CredentialProvider integration on Windows, which interfaces with the OS-level Windows Credential Provider framework used for authentication UI and identity brokering. CWE-472 (External Control of Assumed-Immutable Web Parameter) combined with an integer overflow indicates that a size or length value used in credential-related processing can wrap around, producing inconsistent state that the trusted browser process then acts upon. Because the CredentialProvider runs outside the renderer sandbox and interacts with OS authentication primitives, a successful overflow lets renderer-confined code reach into higher-privileged Windows contexts, enabling a classic sandbox-escape-to-OS-privilege-escalation chain.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 for Windows - upgrade immediately via Chrome's built-in updater or by forcing an update through enterprise management (Google Update / Chrome Browser Cloud Management), then restart the browser to load the new binaries. Enterprise admins managing fleets should verify rollout through the RelaunchNotification and RelaunchWindow policies to ensure users actually restart. Until patching completes, compensating controls include enforcing Microsoft Defender Application Guard or running Chrome under a restricted Windows user account to limit the impact of a successful OS privilege escalation, and tightening Site Isolation and JIT-less mode (--js-flags=--jitless) to raise the cost of the prerequisite renderer compromise; both carry performance penalties and may break some web apps. Track downstream Chromium browsers (Edge, Brave, Opera, Vivaldi) and apply their corresponding updates as they ship. Vendor advisory: https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html.