What is the CVSS score of CVE-2026-11070?

CVE-2026-11070 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11070?

Google Chrome for Windows versions prior to 149.0.7827.53 contain a critical sandbox escape vulnerability that could allow an attacker who has compromised a browser process to execute code with full…. A patch is available.

How to fix or mitigate CVE-2026-11070?

Within 24 hours: Inventory all Windows systems running Chrome versions prior to 149.0.7827.53; identify systems using Chrome Remote Desktop. Within 7 days: Deploy Chrome version 149.0.7827.53 or later via your standard update mechanism (Windows Update, WSUS, or configuration management). Within 30 days: Verify 100% patching compliance across the organization and review Chrome Remote Desktop network access controls.

Google Chrome CVE-2026-11070

EUVD-2026-34518 CRITICAL

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-7jqr-mxmf-66qc

Information Disclosure Google Microsoft

Critical

Disputed · 9.6 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 18:22 vuln.today

CVSS changed

Jun 05, 2026 - 18:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

CRITICAL 9.6

DescriptionCVE.org

Insufficient validation of untrusted input in Chromoting in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the network process to potentially perform a sandbox escape via malicious network traffic. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome on Windows versions prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer/network process to break out of the browser sandbox via crafted Chromoting (Chrome Remote Desktop) network traffic. The flaw is rated CVSS 9.6 due to the scope change from sandboxed process to host, though Google classifies the Chromium severity as Medium. EPSS is very low (0.05%) and no public exploit identified at time of analysis, but a vendor patch is available.

Technical ContextAI

Chromoting is the internal name for the Chrome Remote Desktop component embedded in Chrome's network process on Windows. The root cause is CWE-20 (Improper Input Validation): the Chromoting code path does not sufficiently validate untrusted data received over the network, allowing malformed traffic to influence privileged sandbox-boundary logic. Because the attack requires the attacker to first control the network process, this is a second-stage primitive in a multi-bug exploit chain rather than a single-shot RCE - typical of modern Chrome sandbox escape vulnerabilities where the network/renderer process is sandboxed and the host process is the privileged target.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 for Windows - upgrade immediately via Chrome's auto-update mechanism or by relaunching the browser, and verify the version under chrome://settings/help; see https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. In managed environments, push the updated MSI via Group Policy or your endpoint management tool and force a browser restart. As a temporary compensating control prior to patching, enterprises can disable or block Chrome Remote Desktop usage by policy (RemoteAccessHostFirewallTraversal and related Chromoting policies) and restrict outbound traffic associated with Chrome Remote Desktop relay infrastructure - trade-off is loss of remote-access functionality for users who rely on it. Generic network egress filtering will not fully mitigate since the trigger is malicious traffic delivered to an already-compromised renderer/network process.