What is the CVSS score of CVE-2026-11076?

CVE-2026-11076 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11076?

Google Chrome versions prior to 149.0.7827.53 contain a remote code execution vulnerability in the CSS engine that allows attackers to execute arbitrary code when users visit malicious web pages.. A patch is available.

How to fix or mitigate CVE-2026-11076?

Within 24 hours: Audit Chrome deployment across the organization and identify all systems running versions prior to 149.0.7827.53; send security advisory to users advising caution with web browsing pending patching. Within 7 days: Deploy Google Chrome version 149.0.7827.53 or later through your update mechanism (auto-update for consumer deployments, or managed rollout for enterprise). Within 30 days: Verify 100% of Chrome installations have received the patch through inventory scanning or MDM reporting; document patching completion in your vulnerability management system.

Google Chrome CVE-2026-11076

EUVD-2026-34524 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-06-04 chrome-cve-admin@google.com

GHSA-frfj-pq73-r9p5

RCE Google Memory Corruption

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 03:07 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Type Confusion in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome versions prior to 149.0.7827.53 stems from a type confusion flaw in the CSS engine that lets a remote attacker run arbitrary code within the renderer sandbox by enticing a victim to load a crafted HTML page. The CVSS 8.8 score reflects network reach with low attack complexity but requires user interaction (UI:R) to visit the malicious page, and no public exploit identified at time of analysis. A vendor patch is available via the Chrome Stable channel update published in June 2026.

Technical ContextAI

The flaw is a CWE-843 (Access of Resource Using Incompatible Type - 'Type Confusion') condition inside Chromium's CSS subsystem, which is part of the Blink rendering engine. Type confusion occurs when code allocates or accesses memory assuming one object type but is handed another, allowing attacker-controlled fields to overlap with pointers, vtables, or length values; in a JIT/parser-heavy component like the CSS style engine this typically leads to a controllable read/write primitive and ultimately arbitrary code execution in the renderer process. Because the renderer is sandboxed (CVSS S:U scope unchanged), execution is initially confined to that low-privilege process, though Chromium-class renderer RCEs are routinely chained with separate sandbox-escape bugs in real-world exploit chains.

RemediationAI

Upgrade Google Chrome to version 149.0.7827.53 or later on all supported desktop platforms via the Stable channel update described at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html; on managed fleets, force a browser relaunch via Chrome Enterprise policies (RelaunchNotification / RelaunchWindow) to ensure the fix takes effect rather than waiting for users to restart. Track downstream Chromium-based browsers (Microsoft Edge, Brave, Opera, Electron runtimes) and update them once each vendor ships the corresponding Blink CSS fix. Until patching is complete, compensating controls include enabling Site Isolation (default in modern Chrome) to keep cross-site renderer compromise contained, restricting outbound browsing through a filtering proxy or DNS sinkhole that blocks newly registered and uncategorised domains (trade-off: false positives for legitimate new sites), and disabling JavaScript on untrusted origins via enterprise policy (trade-off: breaks most modern web apps). Avoid relying on ad blockers alone, as the bug is triggered by crafted CSS/HTML that need not be served via ads.