What is the CVSS score of CVE-2026-11060?

CVE-2026-11060 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11060?

Google Chrome on Windows versions before 149.0.7827.53 contains a memory safety vulnerability enabling remote code execution when users visit malicious websites, creating a direct path to system…. A patch is available.

How to fix or mitigate CVE-2026-11060?

Within 24 hours: Conduct inventory of all Windows systems running Chrome and identify those below version 149.0.7827.53. Within 7 days: Deploy Chrome 149.0.7827.53 or later across all Windows systems via patch management system, prioritizing systems with users accessing sensitive data or critical applications. Within 30 days: Validate 100% deployment compliance through automated scanning and post-patch vulnerability assessment.

Google Chrome CVE-2026-11060

EUVD-2026-34508 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-7cc9-46gp-2rh2

Google Memory Corruption RCE Use After Free Microsoft Denial Of Service Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 03:05 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Media in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome on Windows prior to version 149.0.7827.53 allows a remote attacker to escape memory safety boundaries within the renderer sandbox via a crafted HTML page. The flaw stems from a use-after-free condition in the Media component and requires user interaction (visiting a malicious page); no public exploit has been identified at time of analysis. With a CVSS of 8.8 and confirmed Chromium classification, this is a typical browser memory-corruption bug that historically attracts exploit chains.

Technical ContextAI

The vulnerability lives in Chrome's Media subsystem, the Blink/Chromium component responsible for handling audio/video pipelines, decoding, and HTMLMediaElement lifecycle. CWE-416 (Use After Free) indicates that an object is freed while a dangling pointer remains accessible - when that pointer is later dereferenced, attacker-controlled heap data can be substituted, enabling arbitrary code execution within the renderer process. Affected CPE scope per ENISA EUVD is Chrome builds prior to 149.0.7827.53 on Windows; the bug is constrained to the renderer sandbox per the description, meaning exploitation alone does not yield host-level code execution without an additional sandbox escape.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 for Windows - upgrade to this version or later by triggering Chrome's auto-update (chrome://settings/help) or pushing via enterprise management (GPO/Intune). The fix advisory is at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and the upstream tracker at https://issues.chromium.org/issues/499018355. If immediate patching is blocked, compensating controls include enforcing Chrome's site isolation (already default), disabling autoplay media via the AutoplayAllowed enterprise policy to reduce Media-component attack surface (side effect: breaks legitimate video sites), and restricting browsing to allow-listed domains via URLAllowlist (side effect: significant productivity friction). Administrators managing Chromium-derived browsers should monitor those vendors for the corresponding merged fix.