What is the CVSS score of CVE-2026-11086?

CVE-2026-11086 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11086?

Google Chrome versions before 149.0.7827.53 contain a HIGH-severity vulnerability in the Dawn WebGPU component that enables code execution within browser security boundaries, creating a pathway for…. A patch is available.

How to fix or mitigate CVE-2026-11086?

Within 24 hours: Identify all Chrome deployments in your environment and assess affected user population. Within 7 days: Deploy Chrome version 149.0.7827.53 or later to all systems through automated updates or manual distribution. Within 30 days: Verify complete patch compliance across the organization and document remediation in your vulnerability management system.

Google Chrome CVE-2026-11086

EUVD-2026-34534 HIGH

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-q7m4-xrm5-95mx

Google RCE Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 03:08 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Inappropriate implementation in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox-confined arbitrary code execution in Google Chrome versions prior to 149.0.7827.53 stems from an inappropriate implementation in the Dawn WebGPU component, enabling a remote attacker who has already compromised the renderer process to run code inside the sandbox via a crafted HTML page. The CVSS 8.8 rating reflects high impact across confidentiality, integrity, and availability when combined with user interaction (visiting a page), though Chromium classified the underlying severity as Medium. No public exploit identified at time of analysis, but a vendor patch is available in the Stable channel update for desktop.

Technical ContextAI

Dawn is Chromium's open-source, cross-platform implementation of the WebGPU standard, providing the bridge between web content and underlying graphics APIs (Vulkan, Metal, D3D12). Flaws in Dawn are particularly sensitive because the component executes complex GPU command translation logic, often crossing process boundaries between the renderer sandbox and the GPU process. The CWE-20 (Improper Input Validation) classification combined with the 'inappropriate implementation' description suggests Dawn fails to correctly validate or constrain certain WebGPU operations, which a malicious renderer can leverage to achieve code execution still confined within Chrome's sandbox boundary.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - update Chrome via the built-in updater (chrome://settings/help) and restart the browser, which is the primary and recommended fix per the Stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Enterprise administrators should push the update via their managed deployment channel (Google Update, MSI, or MDM policy) and verify the version in chrome://version. As an interim compensating control before patching, WebGPU can be disabled by setting the chrome://flags/#enable-unsafe-webgpu flag to Disabled and disabling WebGPU via enterprise policy or the --disable-features=WebGPU launch flag - this removes the Dawn attack surface entirely but breaks any web applications relying on WebGPU (browser-based 3D rendering, ML inference workloads, advanced graphics demos). Users of downstream Chromium browsers should apply their vendor's corresponding update once available.