What is the CVSS score of CVE-2026-11079?

CVE-2026-11079 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-11079?

Google Chrome versions prior to 149.0.7827.53 contain a memory corruption vulnerability in the media codec component that could enable system compromise through malicious websites or videos.. A patch is available.

How to fix or mitigate CVE-2026-11079?

Within 24 hours: Inventory Chrome versions across managed systems and prepare deployment plan. Within 7 days: Deploy Google Chrome 149.0.7827.53 or later across all systems via automatic update, MDM policy, or manual distribution. Within 30 days: Verify 95%+ installation rate and document any legacy systems unable to update.

Google Chrome CVE-2026-11079

EUVD-2026-34527 HIGH

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-j37v-q84m-vv9p

Information Disclosure Google Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

7.1 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 18:23 vuln.today

CVSS changed

Jun 05, 2026 - 18:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Insufficient validation of untrusted input in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform an out of bounds memory write via a crafted video file. (Chromium security severity: Medium)

AnalysisAI

Out-of-bounds memory write in Google Chrome's codec component prior to version 149.0.7827.53 allows a remote attacker to corrupt memory by serving a crafted video file to a victim who visits a malicious page or views attacker-supplied media. The flaw stems from insufficient input validation in media codec parsing and carries a CVSS 8.8 rating reflecting high impact across confidentiality, integrity, and availability, though no public exploit identified at time of analysis and EPSS exploitation probability is very low at 0.05%.

Technical ContextAI

The vulnerability resides in Chrome's codec subsystem, which is responsible for decoding video streams within the browser's media pipeline (typically running in the renderer or a dedicated media/GPU process). The root cause is classified as CWE-20 (Improper Input Validation): the codec fails to adequately sanity-check fields in an untrusted video container or bitstream before computing buffer offsets, leading to an out-of-bounds write. Such write-primitives in media decoders are historically high-value targets because they execute on attacker-controlled bytes during routine page rendering and can be chained with a sandbox escape for full system compromise. Google rated the underlying Chromium severity as Medium, which suggests the bug is sandbox-contained absent additional escape chains.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - upgrade Stable channel browsers to this version or later via the built-in updater (chrome://settings/help) and restart the browser to apply, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and the Chromium issue tracker entry at https://issues.chromium.org/issues/500028989. For managed fleets, push the update via Chrome Browser Cloud Management or your endpoint management tool and verify version compliance. Users of Chromium-based downstream browsers (Edge, Brave, Opera, Vivaldi) should update once each vendor releases a corresponding rebase. As an interim compensating control before patching, administrators can disable autoplay and restrict untrusted media playback via policy (e.g., AutoplayAllowed=false, URLBlocklist for untrusted media-heavy domains), accepting the trade-off that this breaks legitimate video on internal sites and does not prevent exploitation if a user clicks to play a malicious clip.