What is the CVSS score of CVE-2026-11072?

CVE-2026-11072 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-11072?

Google Chrome for Android prior to version 149.0.7827.53 contains a local code execution vulnerability that allows attackers to execute arbitrary code when users open malicious files.. A patch is available.

How to fix or mitigate CVE-2026-11072?

Within 24 hours: Inventory all Chrome for Android installations and send notification to users about the vulnerability. Within 7 days: Deploy Google Chrome for Android version 149.0.7827.53 or later to all affected devices via MDM or app distribution channels, prioritizing devices with access to sensitive systems. Within 30 days: Verify complete deployment coverage of the patched version and implement quarterly Chrome version monitoring to prevent future exposure gaps.

Google Chrome CVE-2026-11072

EUVD-2026-34520 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-wf67-745c-3hh5

Google Memory Corruption RCE Use After Free Denial Of Service Chrome

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

7.3 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 18:23 vuln.today

CVSS changed

Jun 05, 2026 - 18:22 NVD

7.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 7.8

DescriptionCVE.org

Use after free in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to execute arbitrary code via a malicious file. (Chromium security severity: Medium)

AnalysisAI

Local code execution in Google Chrome for Android prior to 149.0.7827.53 stems from a use-after-free in the WebView component, triggered when a victim opens a malicious file. Per CVSS 7.8 (AV:L/UI:R), exploitation requires local delivery plus user interaction, and there is no public exploit identified at time of analysis (EPSS 0.01%, not in CISA KEV).

Technical ContextAI

The flaw lives in Chrome's WebView on Android - the embeddable rendering component (CPE chrome on android) that hosts web content inside native apps and the browser. CWE-416 (Use After Free) means a heap object is referenced after its lifetime ends; on Android, attackers typically groom the heap and reclaim the freed slot with attacker-controlled data so a later dereference (vtable, function pointer, or object field) yields arbitrary code execution inside the renderer/WebView sandbox. Chromium triaged the issue as Medium severity, and Google's tracker (issues.chromium.org/499238195) and Stable Channel release note are the upstream artifacts.

RemediationAI

Vendor-released patch: Chrome 149.0.7827.53 for Android - update via Google Play or trigger Chrome's in-app update path (chrome://settings/help on desktop equivalent) and confirm rollout to managed Android fleets through MDM (Intune/Workspace ONE) per the advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. There is no documented workaround; as a compensating control on managed Android devices you can restrict installation of untrusted file-handling apps, disable opening of unknown file types from messaging/email clients, and use MDM policy to block the 'Install unknown apps' permission for Chrome - the trade-off is reduced user productivity when handling legitimate downloads. Application developers embedding Android System WebView should also force a WebView update via Play Store, since the same component services third-party apps.