What is the CVSS score of CVE-2026-11089?

CVE-2026-11089 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11089?

Yes, a patch is available for CVE-2026-11089. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11089

EUVD-2026-34537 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-06-04 chrome-cve-admin@google.com

GHSA-96m2-jm5m-f37f

Information Disclosure Google Chrome

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

5.7 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 17:30 vuln.today

CVSS changed

Jun 05, 2026 - 17:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

DescriptionCVE.org

Uninitialized Use in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Uninitialized memory read in Google Chrome's Media component exposes sensitive process memory contents to attackers who have already compromised the renderer process. Specifically, Chrome versions prior to 149.0.7827.53 fail to initialize memory in the Media subsystem, enabling a secondary attacker-controlled read of arbitrary process memory via a crafted HTML page. EPSS stands at 0.03% (11th percentile), no public exploit has been identified, and this vulnerability is not listed in the CISA KEV catalog; the vendor-released patch is available in Chrome 149.0.7827.53.

Technical ContextAI

CWE-457 (Use of Uninitialized Variable) describes the root cause: memory allocated within Chrome's Media subsystem is accessed before it has been properly initialized, allowing prior heap or stack contents to be read. Chrome's multi-process architecture segregates rendering into sandboxed renderer processes; however, when a renderer is already compromised, this uninitialized read primitive can be leveraged to exfiltrate memory contents from that process - potentially including credentials, keys, or other sensitive data resident in memory. The vulnerability is confined to Chrome's Media component (the subsystem handling audio, video, and related media decoding) and is exploitable via a specially crafted HTML page delivered to the victim's browser.

RemediationAI

Update Google Chrome to version 149.0.7827.53 or later, which contains the vendor-released patch for this vulnerability. The fix is detailed in the official stable channel release advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome typically applies updates automatically; administrators managing enterprise deployments should verify fleet-wide version compliance via policy tooling. Because exploitation requires a pre-compromised renderer process, organizations should also prioritize patching any other Chrome vulnerabilities that could enable initial renderer compromise, as this vulnerability functions as a secondary stage in a chained attack. No effective workaround short of the patch mitigates this issue without disabling Media functionality broadly, which is impractical in most environments.