What is the CVSS score of CVE-2026-11094?

CVE-2026-11094 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11094?

Google Chrome on Windows (versions prior to 149.0.7827.53) contains a critical sandbox escape vulnerability that could allow attackers to escalate from a compromised browser process to system-level…. A patch is available.

How to fix or mitigate CVE-2026-11094?

Within 24 hours: Inventory Chrome deployments on Windows systems and identify current versions. Within 7 days: Deploy Chrome version 149.0.7827.53 or later to all Windows endpoints. Within 30 days: Verify patch deployment across all Windows systems and confirm no systems remain on vulnerable versions prior to 149.0.7827.53.

Google Chrome CVE-2026-11094

EUVD-2026-34556 CRITICAL

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-9cwc-pf2g-qx32

Denial Of Service Google Use After Free Memory Corruption Microsoft

Critical

Disputed · 9.6 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

7.9 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 17:26 vuln.today

CVSS changed

Jun 05, 2026 - 17:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

CRITICAL 9.6

DescriptionCVE.org

Use after free in Codecs in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome on Windows prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a use-after-free in the Codecs component triggered by a crafted HTML page. The flaw requires user interaction (visiting a malicious page) and chains with a prior renderer compromise; no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.03%, 11th percentile).

Technical ContextAI

The vulnerability resides in Chrome's Codecs subsystem, which handles media decoding (audio/video) inside the browser process boundary. CWE-416 (Use After Free) indicates that memory is referenced after being freed, allowing an attacker who controls heap layout to reclaim the freed allocation and influence subsequent dereferences, potentially turning a dangling pointer into arbitrary read/write or control-flow hijack. Because Codecs run with broker/privileged-process trust relative to the sandboxed renderer, a UAF reachable from renderer-controlled inputs is a classic sandbox escape primitive. Per CPE/EUVD data the affected build is the Chrome stable channel on Windows prior to 149.0.7827.53.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 or later on Windows - update via Chrome's built-in updater or redeploy through enterprise management (Chrome Browser Cloud Management, SCCM/Intune), then confirm by checking chrome://settings/help. Reference the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. For Chromium-derived browsers, apply the corresponding vendor update once available. As a stopgap before patching, enforce Site Isolation (default on) and consider enabling the optional Strict Site Isolation and v8 sandbox flags; for high-risk users, enable Enhanced Safe Browsing and restrict media autoplay/codec exposure via enterprise policy (AutoplayAllowed=false, restricting MediaCdmEnabled), accepting the trade-off of broken video on some sites. Network-side, blocking untrusted ad networks and enforcing HTTPS-only mode reduces the renderer-RCE delivery surface that this bug chains from.