What is the CVSS score of CVE-2026-11073?

CVE-2026-11073 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11073?

Yes, a patch is available for CVE-2026-11073. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11073

EUVD-2026-34521 MEDIUM

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-24xf-h5qf-w44w

Denial Of Service Use After Free Memory Corruption Google Chrome

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 18:47 vuln.today

CVSS changed

Jun 05, 2026 - 18:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

DescriptionCVE.org

Use after free in WebGL in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Use-after-free in Google Chrome's WebGL component (prior to 149.0.7827.53) exposes process memory to remote attackers who can lure a user to a crafted HTML page. The vulnerability is limited to confidentiality - CVSS C:H/I:N/A:N - meaning an attacker can read potentially sensitive data from Chrome's process memory but cannot write or crash the process per the scored vector. No public exploit has been identified at time of analysis, and EPSS sits at 0.03% (10th percentile), indicating low observed exploitation pressure. Google has shipped a fix in the stable channel release 149.0.7827.53.

Technical ContextAI

WebGL is the browser-native JavaScript API for hardware-accelerated 2D/3D graphics rendering, implemented within Chrome's GPU process. CWE-416 (Use After Free) occurs when a memory region is freed but a dangling pointer to that region is subsequently dereferenced - in a browser graphics context, this typically happens during object lifecycle management in the graphics pipeline (e.g., texture or buffer objects being destroyed while still referenced by a draw call). Dereferencing freed memory in a controlled way can expose stale heap contents to the attacker via JavaScript, enabling a read-primitive that leaks process memory. The affected component is confined to Chrome prior to version 149.0.7827.53 as identified by EUVD-2026-34521 and confirmed by the Google Chrome Releases advisory.

RemediationAI

Update Google Chrome to version 149.0.7827.53 or later via the browser's built-in update mechanism (Settings > Help > About Google Chrome) or through enterprise deployment tools such as Google Admin or WSUS. The fix is confirmed in the stable channel release advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. For organizations that cannot immediately patch, a compensating control is to block or restrict access to WebGL via enterprise policy (Chrome policy 'WebGLEnabled': false), which disables the affected subsystem entirely but will break WebGL-dependent web applications including Maps, 3D content, and some conferencing tools - weigh this disruption against exposure. Site Isolation (already enabled by default in Chrome) partially limits cross-site memory leakage, providing marginal additional defense-in-depth but not mitigating the vulnerability directly.