What is the CVSS score of CVE-2026-11082?

CVE-2026-11082 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11082?

Google Chrome on Android versions prior to 149.0.7827.53 contain a sandbox escape vulnerability (CVE-2026-11082, CVSS 9.6) that could allow attackers to achieve full device compromise after…. A patch is available.

How to fix or mitigate CVE-2026-11082?

Within 24 hours: Inventory all Android devices running Chrome in your environment (via MDM/EMM or asset management systems). Within 7 days: Deploy Chrome version 149.0.7827.53 or later to all Android endpoints via device management policy; for BYOD, issue security advisory requesting manual user updates. Within 30 days: Verify update compliance through MDM reporting and re-inventory non-compliant devices.

Google Chrome CVE-2026-11082

EUVD-2026-34530 CRITICAL

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-qj6g-j854-32gc

Information Disclosure Google Use After Free Memory Corruption

Critical

Disputed · 9.6 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

7.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 18:24 vuln.today

CVSS changed

Jun 05, 2026 - 18:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

CRITICAL 9.6

DescriptionCVE.org

Race in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome on Android prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a race condition in the GPU process triggered by a crafted HTML page. The flaw is a use-after-free (CWE-416) reachable through normal web content rendering, and while no public exploit is identified at time of analysis, the EPSS percentile of 11% suggests low near-term opportunistic exploitation likelihood.

Technical ContextAI

The vulnerability resides in Chrome's GPU process on Android, which handles hardware-accelerated rendering, WebGL, and compositing on behalf of sandboxed renderer processes via the Mojo IPC interface. CWE-416 (Use-After-Free) combined with a race condition indicates that concurrent operations between threads in the GPU process can free a memory object while another execution path still holds a reference to it, enabling an attacker who controls the renderer to manipulate freed memory and corrupt GPU process state. Because the GPU process runs at a higher privilege level than the renderer sandbox on Android, successful exploitation crosses a critical security boundary.

RemediationAI

Upgrade Google Chrome on Android to version 149.0.7827.53 or later, which contains the vendor-released patch as confirmed by the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. On managed Android fleets, push the update via Google Play managed configurations or MDM-enforced minimum-version policies. As a temporary compensating control while updates roll out, administrators can disable hardware acceleration in chrome://flags (specifically the GPU rasterization and accelerated 2D canvas flags), which reduces attack surface in the GPU process at the cost of significantly degraded rendering performance and battery life on graphics-heavy pages; this does not eliminate all GPU process exposure but narrows it.