What is the CVSS score of CVE-2026-11059?

CVE-2026-11059 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11059?

Google Chrome versions prior to 149.0.7827.53 contain a remote code execution vulnerability in the Blink rendering engine that allows attackers to execute code within the browser when users visit…. A patch is available.

How to fix or mitigate CVE-2026-11059?

Within 24 hours: Audit current Chrome versions across all managed endpoints to identify affected users. Within 7 days: Deploy Chrome 149.0.7827.53 or later to all endpoints using your standard software deployment process (WSUS, Jamf, configuration management). Within 30 days: Verify 100% compliance with the patched version and review security logs for any pre-patch exploitation indicators.

Google Chrome CVE-2026-11059

EUVD-2026-34507 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-w8cf-3m84-6mfm

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 03:04 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Blink in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome's Blink rendering engine prior to version 149.0.7827.53 allows a remote attacker to execute arbitrary code within the renderer sandbox by enticing a user to visit a crafted HTML page. The flaw is a use-after-free memory corruption issue (CWE-416) carrying a CVSS 8.8 score, with a vendor patch already shipped via the Chrome stable channel and no public exploit identified at time of analysis.

Technical ContextAI

Blink is the open-source rendering engine used by Chrome and other Chromium-based browsers (Edge, Opera, Brave) to parse and render HTML, CSS, and execute layout/DOM operations. The root cause is CWE-416 (Use After Free), a memory corruption class where an object is freed but a dangling pointer continues to be dereferenced, allowing an attacker who controls heap layout via crafted DOM/JS interactions to reclaim the freed slot and gain control over object vtables or function pointers. Successful exploitation yields code execution inside the renderer process, which is constrained by Chrome's multi-process sandbox - full system compromise typically requires chaining with a separate sandbox-escape vulnerability.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - upgrade immediately via the stable channel and restart the browser to load the new binary, then verify via chrome://settings/help. Administrators managing fleets should push the update through enterprise management (Group Policy, MDM, or Chrome Browser Cloud Management) and monitor downstream Chromium-based browsers (Edge, Brave, Opera, Vivaldi) for their respective patched releases. As an interim compensating control where patching is delayed, restrict browsing to trusted sites via web filtering, disable JavaScript on untrusted origins (which breaks most modern web apps), or route browsing through a remote browser isolation service; site-isolation is already enabled by default in Chrome and provides additional defense by keeping cross-origin renderers in separate processes. See the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html.