What is the CVSS score of CVE-2026-11087?

CVE-2026-11087 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11087?

Yes, a patch is available for CVE-2026-11087. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11087

EUVD-2026-34535 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-06-04 chrome-cve-admin@google.com

GHSA-3g3j-wmqv-ccgw

Information Disclosure Google Chrome

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.8 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 17:29 vuln.today

CVSS changed

Jun 05, 2026 - 17:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

DescriptionCVE.org

Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's ANGLE graphics component (versions prior to 149.0.7827.53) enables a remote attacker who has already compromised the renderer process to read sensitive data from other origins via a crafted HTML page. The root cause is CWE-457 (Use of Uninitialized Variable) in ANGLE - residual memory contents in the graphics pipeline can be read before proper initialization, exposing data across origin boundaries. EPSS is very low at 0.03% (11th percentile) and no public exploit or CISA KEV listing has been identified, but the cross-origin data access impact makes this relevant in chained exploit scenarios.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Google Chrome's cross-platform graphics abstraction layer that translates OpenGL ES calls to platform-native graphics APIs (DirectX on Windows, Metal on macOS, Vulkan elsewhere). CWE-457 (Use of Uninitialized Variable) in this context means that memory buffers or shader resources within the ANGLE pipeline are accessed before being fully initialized, allowing their residual contents - potentially containing rendered data from other browser origins or tabs - to be read by a malicious page. This class of bug in a graphics subsystem is particularly sensitive because GPU memory is frequently reused across security boundaries. Affected CPE corresponds to Google Chrome prior to version 149.0.7827.53 across desktop platforms.

RemediationAI

The vendor-released fix is Google Chrome 149.0.7827.53, available via Chrome's built-in update mechanism or the official release page referenced at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Enterprise deployments using Chrome management policies should push this version immediately. As a compensating control prior to patching, organizations may consider enabling Chrome's Site Isolation feature (--site-per-process) if not already active, which limits cross-origin memory access, though this does not eliminate the underlying ANGLE bug and may affect performance. Restricting access to untrusted web content via enterprise browser policies (allowlisting, web filtering) reduces exposure, but only mitigates the user-interaction vector, not the underlying renderer compromise prerequisite.