What is the CVSS score of CVE-2026-11091?

CVE-2026-11091 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-11091?

Google Chrome users across the organization face potential data exposure and system stability risks from a memory access vulnerability for which no public exploit has been identified at time of…. A patch is available.

How to fix or mitigate CVE-2026-11091?

Within 24 hours: Enumerate all Chrome versions in use across managed and unmanaged endpoints; notify users of critical security update requirement. Within 7 days: Deploy Chrome 149.0.7827.53 or later to all managed instances via MDM/software distribution; for unmanaged devices, communicate mandatory self-service update deadline. Within 30 days: Audit Chrome version inventory to confirm patch coverage; escalate any non-compliant instances for remediation or isolation.

Google Chrome CVE-2026-11091

EUVD-2026-34539 HIGH

Out-of-bounds Read (CWE-125)

2026-06-04 chrome-cve-admin@google.com

GHSA-9p75-crhx-vjqc

Buffer Overflow Information Disclosure Google

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 17:24 vuln.today

CVSS changed

Jun 05, 2026 - 17:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Inappropriate implementation in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Out-of-bounds memory read in the Dawn WebGPU implementation of Google Chrome prior to 149.0.7827.53 allows a remote attacker to access memory outside intended bounds via a crafted HTML page. Exploitation requires the victim to visit an attacker-controlled page, and no public exploit identified at time of analysis. Google rates the Chromium-internal severity as Medium, while NVD assigns CVSS 8.8 reflecting the broad impact on confidentiality, integrity, and availability if successfully triggered.

Technical ContextAI

Dawn is Chromium's open-source, cross-platform implementation of the WebGPU standard, providing a low-level GPU abstraction layer that translates WebGPU API calls into native graphics backends (Vulkan, Metal, D3D12). Because Dawn parses and processes attacker-influenced GPU command buffers and shader inputs originating from web content, bugs in its validation logic can yield memory-safety issues. The CWE-125 (Out-of-bounds Read) classification indicates that the implementation reads memory past the end (or before the start) of an intended buffer, which in a GPU/driver context can leak sensitive process memory or destabilize the renderer. The Buffer Overflow and Information Disclosure tags reinforce that the underlying defect involves boundary checks on Dawn-managed memory regions.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 or later on the Stable channel - update via Chrome's built-in updater or redeploy managed installs, then relaunch the browser to apply. Administrators of Chromium-derivative browsers and Electron apps should track their respective vendor advisories and rebuild against the patched Dawn version. As a compensating control until patches roll out, disable WebGPU by setting the chrome://flags/#enable-unsafe-webgpu flag to Disabled or via enterprise policy (the WebGPU feature can be turned off through the chrome://flags or via group policy by blocking chrome://gpu features), which removes the attack surface at the cost of breaking sites that rely on WebGPU rendering, ML inference, or accelerated graphics. Refer to the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and Chromium issue tracker entry https://issues.chromium.org/issues/500162791 for additional detail.