What is the CVSS score of CVE-2026-11092?

CVE-2026-11092 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-11092?

Google Chrome DevTools versions prior to 149.0.7827.53 contain a privilege escalation vulnerability exploitable through malicious browser extensions, affecting all Chrome deployments in the…. A patch is available.

How to fix or mitigate CVE-2026-11092?

24 hours: Communicate Chrome update availability to users and IT administrators. 7 days: Deploy Chrome 149.0.7827.53 or later across all managed and unmanaged endpoints; prioritize systems with users holding elevated privileges. 30 days: Verify patch deployment completeness and conduct compliance audit of browser extension policies.

Google Chrome CVE-2026-11092

EUVD-2026-34540 HIGH

Client-Side Enforcement of Server-Side Security (CWE-602)

2026-06-04 chrome-cve-admin@google.com

GHSA-3gfh-6wg3-9q56

Privilege Escalation Google

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

6.6 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 17:25 vuln.today

CVSS changed

Jun 05, 2026 - 17:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Insufficient policy enforcement in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to perform privilege escalation via a crafted Chrome Extension. (Chromium security severity: Medium)

AnalysisAI

Privilege escalation in Google Chrome DevTools versions prior to 149.0.7827.53 allows attackers to abuse insufficient policy enforcement through a malicious browser extension. The flaw requires user interaction to install a crafted extension, after which the attacker can gain elevated privileges within the browser context. No public exploit identified at time of analysis, and EPSS scoring (0.01%) indicates very low near-term exploitation probability despite the high CVSS rating.

Technical ContextAI

The vulnerability resides in Chrome's DevTools subsystem, which exposes powerful debugging and inspection capabilities (DOM access, network interception, JavaScript execution) that normally require explicit user consent. CWE-602 (Client-Side Enforcement of Server-Side Security) indicates the policy boundary intended to restrict extension capabilities against DevTools was enforced incorrectly, allowing a crafted extension to bypass the trust boundary between extension sandbox and privileged DevTools APIs. Chromium classifies the underlying severity as Medium, suggesting the escalation is bounded within the browser rather than achieving OS-level code execution. CPE data was not provided, but EUVD identifies affected scope as Chrome builds below 149.0.7827.53.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - upgrade Chrome desktop installations to this version or later via the Stable channel update at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and restart the browser to apply. In managed environments, accelerate distribution via Chrome Browser Cloud Management or your existing software-deployment tooling, and verify Chromium-based browser vendors (Edge, Brave, Opera) have rebased onto a patched Chromium build before considering them safe. As compensating controls until patching completes, enforce ExtensionInstallAllowlist / ExtensionInstallBlocklist enterprise policies to prevent installation of unvetted extensions, and consider DeveloperToolsAvailability=DeveloperToolsDisallowed for high-risk user populations - note this breaks legitimate web-developer workflows and should be scoped accordingly. The chromium issue tracker entry (https://issues.chromium.org/issues/500170887) is referenced but typically remains restricted until well after public disclosure.