What is the CVSS score of CVE-2026-11080?

CVE-2026-11080 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-11080?

Google Chrome for Android contains a critical memory corruption vulnerability that could enable attackers to execute code on affected devices when users visit a malicious webpage.. A patch is available.

How to fix or mitigate CVE-2026-11080?

24 hours: Audit Chrome for Android versions across managed and BYOD devices to identify exposure scope; notify affected users of pending security update. 7 days: Deploy Chrome for Android version 149.0.7827.53 or later to all managed devices via MDM; distribute manual-update guidance to BYOD users. 30 days: Measure patch deployment coverage; monitor device logs and security telemetry for exploitation attempts.

Google Chrome CVE-2026-11080

EUVD-2026-34528 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-8wpx-gvvh-8rcv

Denial Of Service Use After Free Memory Corruption Google Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 18:24 vuln.today

CVSS changed

Jun 05, 2026 - 18:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Heap corruption in Google Chrome for Android's WebView component prior to version 149.0.7827.53 allows remote attackers to potentially execute code or crash the browser by luring victims to a crafted HTML page. The flaw is a use-after-free (CWE-416) rated CVSS 8.8 due to network reach and high impact across confidentiality, integrity, and availability, though user interaction is required. No public exploit identified at time of analysis and EPSS exploitation probability is very low (0.03%).

Technical ContextAI

WebView is the Android system component (based on the Chromium engine) that embedded apps use to render web content in-process. A use-after-free (CWE-416) occurs when memory is freed while a dangling reference remains usable, allowing an attacker who controls subsequent heap allocations to reclaim that memory with controlled data and corrupt object layouts. In a renderer-class component like WebView, successful exploitation of such heap corruption typically enables arbitrary code execution within the renderer sandbox, with potential for further chaining to escape sandboxing. Google classifies the Chromium severity as Medium despite the NVD CVSS of 8.8, reflecting Google's internal weighting of exploitability and sandbox containment.

RemediationAI

Vendor-released patch: Chrome 149.0.7827.53 - update Google Chrome for Android and Android System WebView to 149.0.7827.53 or later via the Google Play Store, and ensure managed Android fleets receive WebView updates promptly since embedded WebViews in third-party apps inherit the vulnerable code until the system WebView is patched. Confirm the rollout details via the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and the Chromium tracker at https://issues.chromium.org/issues/500032538. As a compensating control until updates propagate, restrict users from visiting untrusted web content in apps that embed WebView (enterprise MDM policies can block sideloaded browsers or restrict in-app browsing), and consider disabling JavaScript in custom WebView-based apps where feasible - noting this will break most modern web functionality and is only viable for narrowly scoped kiosk or single-purpose apps.