What is the CVSS score of CVE-2026-11068?

CVE-2026-11068 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11068?

Google Chrome contains a critical vulnerability (CVE-2026-11068) that allows attackers to execute code on employee desktops by tricking users into visiting malicious webpages, creating direct risk of…. A patch is available.

How to fix or mitigate CVE-2026-11068?

Within 24 hours: Identify all systems running Chrome versions before 149.0.7827.53 using endpoint management tools and establish patch deployment schedule. Within 7 days: Deploy Chrome 149.0.7827.53 or later across all organization endpoints using standard patch management processes, prioritizing corporate-owned systems and high-risk user groups. Within 30 days: Conduct 100% patch compliance audit and implement mandatory Chrome auto-update policies to prevent future version lag on critical vulnerabilities.

Google Chrome CVE-2026-11068

EUVD-2026-34516 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-62jh-ghq5-2f65

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 03:06 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in WebSockets in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome desktop versions prior to 149.0.7827.53 stems from a use-after-free flaw in the WebSockets implementation that an attacker can trigger by luring a victim to a crafted HTML page. Although code execution is constrained to Chrome's renderer sandbox, the CVSS 8.8 rating reflects high impact across confidentiality, integrity, and availability, and no public exploit identified at time of analysis. Google has shipped a fix in the stable channel, but the bug typically becomes a building block for full chain exploits when combined with a sandbox escape.

Technical ContextAI

The vulnerability resides in Chrome's WebSockets stack, the bidirectional messaging layer built on top of the HTTP upgrade handshake that browsers expose to JavaScript through the WebSocket API. The root cause is CWE-416 (Use After Free), meaning code paths in the WebSocket handler retain or dereference a pointer to an object whose backing memory has already been released, allowing an attacker who controls allocation patterns to reclaim the freed slot with attacker-shaped data. Because WebSocket connections are initiated and driven from the renderer process via JavaScript, the affected component runs inside Chrome's site-isolated renderer sandbox (Scope:Unchanged in the CVSS vector), and exploitation yields arbitrary code execution at renderer privilege rather than full host compromise. Chromium tracks the issue internally at issues.chromium.org/issues/499194333, and the EUVD entry EUVD-2026-34516 maps to fixed builds at or above 149.0.7827.53.

RemediationAI

Vendor-released patch: Chrome 149.0.7827.53 or later on the stable desktop channel - update immediately via Chrome's built-in updater or by pushing the new MSI/PKG/DEB through enterprise management, as documented in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Administrators of Chromium-derived browsers should track their vendor's rebase to the equivalent milestone and apply that update as soon as it ships. As a temporary compensating control until updates roll out, restrict outbound WebSocket connectivity at the egress proxy by blocking the HTTP Upgrade: websocket handshake or limiting allowed ws/wss destinations to known-good domains, accepting the trade-off that any internal application relying on WebSockets (chat, collaborative editors, live dashboards, dev tooling) will break; deploying site isolation enforcement and disabling JIT via the chrome://flags/#disable-javascript-jit policy further raises the bar for memory corruption exploitation at a measurable performance cost.