What is the CVSS score of CVE-2026-11071?

CVE-2026-11071 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11071?

Google Chrome for Linux is vulnerable to a high-severity information disclosure vulnerability (CVE-2026-11071) that could allow attackers to exfiltrate sensitive user data, with a CVSS score of 8.8…. A patch is available.

How to fix or mitigate CVE-2026-11071?

Within 24 hours: Identify all Google Chrome installations on Linux systems and initiate staged deployment of version 149.0.7827.53 or later, prioritizing critical business systems. Within 7 days: Complete patch rollout across all Linux-based Chrome deployments and verify version compliance via endpoint monitoring. Within 30 days: Validate patch deployment metrics and conduct post-remediation security assessment.

Google Chrome CVE-2026-11071

EUVD-2026-34519 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-m4x7-9rr5-qr3w

Denial Of Service Google Use After Free Memory Corruption

High

Disputed · 8.8 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

5.7 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 18:22 vuln.today

CVSS changed

Jun 05, 2026 - 18:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Base in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Information disclosure in Google Chrome on Linux prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to read sensitive data from process memory by serving a crafted HTML page that triggers a use-after-free in the Base component. The flaw is rated Medium by Chromium but scored CVSS 8.8 in NVD, and no public exploit identified at time of analysis with an EPSS of 0.03%.

Technical ContextAI

The defect lives in Chrome's Base component, a foundational library shared across the browser providing core primitives (containers, memory utilities, task scheduling) used by the renderer and other processes. CWE-416 (Use After Free) means an object is referenced after its memory has been freed, which on Linux can leak adjacent heap contents - pointers, tokens, or document data - to attacker-controlled code running inside an already-exploited renderer. This bug is therefore a sandbox-adjacent primitive that aids post-exploitation memory inspection rather than an initial code-execution vector, and it specifically affects the Linux build of Chrome (versions prior to 149.0.7827.53).

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 for Linux - upgrade immediately by triggering Chrome's built-in updater (chrome://settings/help) or by deploying the new stable package through your Linux distribution or enterprise management channel, then restarting the browser to load the fixed binary. Enterprises should validate the rollout via the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and audit fleet versions to ensure no instance remains below 149.0.7827.53. No workaround is documented; as a temporary compensating control, restrict Linux users to browsing only trusted sites and enforce Chrome's site isolation (already on by default) to limit cross-origin renderer reuse, accepting the trade-off that this does not block the bug itself and only narrows the blast radius if a renderer is already compromised.