What is the CVSS score of CVE-2026-11066?

CVE-2026-11066 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11066?

Google Chrome versions prior to 149.0.7827.53 contain a critical sandbox escape vulnerability (CVSS 9.6) that could allow attackers to gain system-level access by delivering a malicious webpage to…. A patch is available.

How to fix or mitigate CVE-2026-11066?

Within 24 hours: Determine Chrome deployment scope across your endpoint fleet (percentage of devices, cloud vs. on-premises), identify Chrome-critical business functions, and prepare patch timeline. Within 7 days: Roll out Google Chrome 149.0.7827.53 or later via your MDM/SCCM platform to all managed endpoints; notify users of unmanaged devices with a mandatory update deadline. Within 30 days: Confirm ≥95% deployment coverage, enforce Chrome auto-updates organization-wide, and monitor threat intelligence feeds for confirmed exploitation activity.

Google Chrome CVE-2026-11066

EUVD-2026-34514 CRITICAL

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-jxr8-9v9f-gfq8

Information Disclosure Google

Critical

Disputed · 9.6 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 19:26 vuln.today

CVSS changed

Jun 05, 2026 - 19:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:17 nvd

CRITICAL 9.6

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome prior to 149.0.7827.53 allows remote attackers to break out of the renderer sandbox via a crafted HTML page that exploits insufficient input validation in the ANGLE graphics layer. The flaw requires the victim to visit attacker-controlled content (UI:R) but no authentication, and the scope-changing CVSS 9.6 reflects the impact of escaping browser process isolation. EPSS is very low (0.05%, 15th percentile) and there is no public exploit identified at time of analysis.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chromium's translation layer that maps WebGL and OpenGL ES calls onto the host's native graphics API (Direct3D on Windows, Metal on macOS, Vulkan/OpenGL on Linux), and is exposed to any web content that uses WebGL or related GPU surfaces. The root cause is CWE-20 (Improper Input Validation): untrusted data crossing into ANGLE is not sufficiently validated before being acted on by GPU-process code, enabling a renderer-originated payload to influence GPU-process logic and escape the renderer sandbox. Because ANGLE runs in the more-privileged GPU process, a successful exploit crosses the renderer/GPU trust boundary, which is what produces the scope-changed (S:C) CVSS impact.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - update Stable channel desktop installs to 149.0.7827.53 or later via the standard auto-update mechanism (chrome://settings/help) and force-restart browsers in managed fleets to ensure the new binary is loaded; see the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and tracking issue https://issues.chromium.org/issues/499124128. For downstream Chromium-based browsers, apply the vendor's corresponding update once published. If patching must be deferred, the most direct compensating control is to disable hardware acceleration in chrome://settings (System → 'Use graphics acceleration when available' off), which forces software rendering and avoids the ANGLE GPU path at the cost of reduced performance for WebGL/Canvas/video workloads; disabling WebGL via enterprise policy (DefaultWebGLSetting / WebGL allow-listing) further reduces attack surface but breaks legitimate WebGL sites such as Google Maps and 3D viewers.