What is the CVSS score of CVE-2026-11088?

CVE-2026-11088 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11088?

Google Chrome prior to version 149.0.7827.53 contains a critical vulnerability that allows escalation from browser compromise to full system compromise via sandbox escape.. A patch is available.

How to fix or mitigate CVE-2026-11088?

Within 24 hours: Identify all systems running Chrome and verify current versions below 149.0.7827.53. Within 7 days: Deploy Chrome version 149.0.7827.53 or later across all managed endpoints using established patch management processes. Within 30 days: Validate patch deployment success (95%+ compliance) and monitor for version rollbacks.

Google Chrome CVE-2026-11088

EUVD-2026-34536 CRITICAL

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-06-04 chrome-cve-admin@google.com

GHSA-92wq-h858-h7w9

Buffer Overflow Google

Critical

Disputed · 9.6 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

8.1 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 17:23 vuln.today

CVSS changed

Jun 05, 2026 - 17:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

CRITICAL 9.6

DescriptionCVE.org

Integer overflow in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome's ANGLE graphics layer prior to version 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page. The flaw stems from an integer overflow (CWE-472) in ANGLE and requires user interaction (visiting a malicious page) plus a prior renderer compromise to chain into full sandbox escape. No public exploit identified at time of analysis, and EPSS is very low (0.03%), but Google rates the underlying issue as Medium severity within Chromium.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is the cross-platform translation layer Chrome uses to map WebGL/OpenGL ES calls onto the host system's native graphics APIs (Direct3D on Windows, Metal on macOS, Vulkan/OpenGL on Linux). Because ANGLE runs inside the GPU process - which sits at a higher privilege boundary than the renderer sandbox - memory corruption here is a classic stepping-stone for sandbox escapes. CWE-472 (External Control of Assumed-Immutable Web Parameter) is the CWE classifier assigned, though the underlying defect is described by Google as an integer overflow, suggesting arithmetic on untrusted size/count values from the renderer that is later used in buffer or pointer calculations within the GPU process, enabling out-of-bounds writes that the attacker leverages to escape sandboxing.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - update via Chrome's built-in auto-updater or by visiting chrome://settings/help and restarting the browser, with reference to the stable channel announcement at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Enterprise fleets managed via group policy should push the update through Chrome Browser Cloud Management or the equivalent MDM channel and confirm the version on endpoints. As a compensating control until update, administrators can disable hardware-accelerated WebGL/GPU through the --disable-webgl and --disable-gpu command-line flags or the corresponding HardwareAccelerationModeEnabled enterprise policy, which removes the ANGLE attack surface at the cost of degraded graphics performance and broken WebGL-dependent applications such as Google Earth, Figma, and many in-browser games. Chromium-based browser users should monitor their vendor's release notes for the merged fix.