What is the CVSS score of CVE-2026-11063?

CVE-2026-11063 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11063?

Google Chrome versions before 149.0.7827.53 on Windows contain a critical sandbox escape vulnerability (CVE-2026-11063, CVSS 9.6) that could allow full system compromise if the browser renderer is…. A patch is available.

How to fix or mitigate CVE-2026-11063?

Within 24 hours: Identify and notify all teams using Chrome on Windows of the vulnerability and patch availability. Within 7 days: Deploy Chrome version 149.0.7827.53 or later through your patch management system, prioritizing Windows endpoints. Within 30 days: Verify patch deployment completion across all managed Chrome installations and confirm version 149.0.7827.53 or later is running.

Google Chrome CVE-2026-11063

EUVD-2026-34511 CRITICAL

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-2qgr-rh75-r9jq

Information Disclosure Google Microsoft

Critical

Disputed · 9.6 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

8.2 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 19:25 vuln.today

CVSS changed

Jun 05, 2026 - 19:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:17 nvd

CRITICAL 9.6

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in WebNN in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome on Windows before 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page that abuses the WebNN (Web Neural Network) API. The flaw stems from insufficient validation of untrusted input (CWE-20) reaching the WebNN component, and exploitation requires user interaction (visiting an attacker-controlled page) plus a prior renderer-compromise primitive. There is no public exploit identified at time of analysis, and the EPSS probability is very low (0.04%).

Technical ContextAI

WebNN is Chrome's emerging Web Neural Network API that exposes machine-learning acceleration primitives to web content, with portions of its implementation running across renderer and browser/GPU process boundaries on Windows. Because WebNN-related IPC messages traverse a sandbox boundary, any privileged process handling them must rigorously validate parameters originating from the less-trusted renderer. The root cause class is CWE-20 (Improper Input Validation): a more-privileged Chrome process accepted attacker-controlled data from the renderer without sufficient checks, enabling code or memory state to influence a process running outside the renderer sandbox. The affected component is Chromium's WebNN subsystem as shipped in desktop Chrome on Windows, prior to the 149.0.7827.53 stable build.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 (stable channel) on Windows - update all Chrome installs to this version or later via the built-in updater or managed deployment, as documented in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. For fleets that cannot patch immediately, reduce exposure by disabling or blocking the WebNN feature where supported (e.g., via the WebNN/WebNNDeveloper enterprise/feature flags or Chrome enterprise policy controls), accepting the trade-off that web apps relying on on-device ML acceleration will fall back to slower paths or fail; additionally, restrict browsing of untrusted sites and ensure the Windows host renderer sandbox and Win32k lockdown mitigations remain enabled, since this bug is only reachable after a separate renderer compromise. Verify update status across Chromium-based variants that pull from the same engine, but note this advisory specifically names Google Chrome on Windows.