What is the CVSS score of CVE-2026-11065?

CVE-2026-11065 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11065?

Chrome versions prior to 149.0.7827.53 contain a critical flaw enabling system-wide compromise if the browser is exploited, putting all organizational Chrome users at direct risk of data loss and…. A patch is available.

How to fix or mitigate CVE-2026-11065?

24 hours: Identify and inventory all Chrome installations and current versions in use across the organization. 7 days: Deploy Chrome 149.0.7827.53 or later to all endpoints using Windows Update, enterprise MDM, or centralized patch management systems. 30 days: Confirm 100% patch compliance across all Chrome deployments and document closure of remediation.

Google Chrome CVE-2026-11065

EUVD-2026-34513 CRITICAL

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-m5v8-3qrp-fvxw

Denial Of Service Google Use After Free Memory Corruption

Critical

Disputed · 9.6 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 19:25 vuln.today

CVSS changed

Jun 05, 2026 - 19:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:17 nvd

CRITICAL 9.6

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 149.0.7827.53 enables a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page targeting a use-after-free in the ANGLE graphics layer. The flaw requires user interaction (visiting a malicious page) and changes scope, yielding high confidentiality, integrity, and availability impact on the host. No public exploit identified at time of analysis and EPSS probability is very low (0.03%, 11th percentile), but a vendor patch is available.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's translation layer that maps OpenGL ES API calls onto the platform-native graphics backend (Direct3D on Windows, Metal on macOS, Vulkan/OpenGL on Linux), and it runs with elevated privileges relative to the sandboxed renderer because it brokers GPU access. CWE-416 (Use After Free) means memory is referenced after it has been released, allowing an attacker who controls subsequent allocations to manipulate the freed object's contents and hijack control flow or corrupt state. Because ANGLE sits at the renderer/GPU boundary, a UAF here is a classic stepping stone from a compromised renderer to GPU-process or sandbox-escape primitives, which matches the CVSS Scope:Changed designation in the vector.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 on the desktop stable channel - update immediately via the built-in updater (chrome://settings/help) or by redeploying via managed-update channels, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Downstream Chromium-based browsers should be updated to whatever release incorporates the same ANGLE fix once their vendors publish it; in the interim, organizations can reduce exposure by enforcing Site Isolation (already default in Chrome) and blocking unknown sites via SafeSites/Enterprise policy, with the trade-off of administrative overhead and potential breakage of legitimate sites. As a more aggressive mitigation, disabling hardware-accelerated graphics via the --disable-gpu flag or chrome://flags would reduce the ANGLE attack surface but degrades rendering performance for video, WebGL, and Canvas-heavy applications and is generally not recommended over patching.