What is the CVSS score of CVE-2026-11077?

CVE-2026-11077 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11077?

Google Chrome versions prior to 149.0.7827.53 contain a remote code execution vulnerability in the WebGPU renderer that allows attackers to execute arbitrary code on user systems by serving malicious…. A patch is available.

How to fix or mitigate CVE-2026-11077?

Within 24 hours: Distribute security alert to all Chrome users and inventory Chrome deployment across the organization. Within 7 days: Deploy Google Chrome version 149.0.7827.53 or later to all endpoints. Within 30 days: Audit and verify patch compliance across all user devices.

Google Chrome CVE-2026-11077

EUVD-2026-34525 HIGH

Out-of-bounds Read (CWE-125)

2026-06-04 chrome-cve-admin@google.com

GHSA-wm73-cxm9-jwx9

Information Disclosure Google Buffer Overflow RCE Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 03:07 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Bad cast in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome versions prior to 149.0.7827.53 allows a remote attacker to execute arbitrary code within the renderer sandbox by serving a crafted HTML page that triggers a bad cast in the Dawn WebGPU implementation. The flaw carries a CVSS 8.8 rating with user interaction required (visiting a malicious page), and no public exploit has been identified at time of analysis despite Google rating the underlying Chromium severity as Medium. The vendor has released a patched stable channel build addressing this issue alongside other fixes.

Technical ContextAI

Dawn is Chromium's cross-platform implementation of the WebGPU standard, providing GPU-accelerated graphics and compute capabilities to web content through a C++ abstraction layer over native APIs such as Vulkan, Metal, and Direct3D 12. A 'bad cast' (incorrect type conversion, related to CWE-125 out-of-bounds read class) occurs when an object is interpreted as a type incompatible with its actual layout, causing the engine to dereference or operate on memory under attacker influence. Because Dawn runs inside Chrome's GPU/renderer process boundary, exploitation yields code execution constrained to the sandboxed process rather than the underlying OS, but it still represents a powerful primitive often chained with a sandbox escape for full system compromise.

RemediationAI

Vendor-released patch: update Google Chrome to 149.0.7827.53 or later via the stable channel auto-update mechanism, with details at the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html). Enterprises managing Chrome via group policy should verify the LastVersion enforcement and accelerate the deployment ring for this update, and operators of Chromium-derivative browsers (Edge, Brave, Opera, Electron-based apps) should track their respective vendor releases that incorporate the upstream Dawn fix. As a compensating control until patching, administrators can disable WebGPU via the chrome://flags 'Unsafe WebGPU' setting or the WebGPU enterprise policy, with the trade-off of breaking sites that rely on GPU compute or modern graphics APIs; blocking untrusted browsing destinations via URL allowlisting reduces exposure but does not address watering-hole or malvertising delivery.