What is the CVSS score of CVE-2026-11095?

CVE-2026-11095 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11095?

Google Chrome versions prior to 149.0.7827.53 contain a critical sandbox bypass vulnerability that could allow attackers to achieve full system compromise.. A patch is available.

How to fix or mitigate CVE-2026-11095?

Within 24 hours: Push mandatory Chrome update to version 149.0.7827.53 or later via MDM; block legacy versions on managed endpoints; audit browser security logs for renderer exploitation attempts. Within 7 days: Verify 100% deployment compliance through endpoint management tools; enable renderer code integrity features; document any exemptions requiring later update. Within 30 days: Conduct forensic analysis of Chrome processes for post-compromise indicators of compromise; implement automatic Chrome update policy with no user deferral option.

Google Chrome CVE-2026-11095

EUVD-2026-34557 CRITICAL

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-83x5-x4f9-cc5w

Information Disclosure Google Red Hat Suse Chrome

Critical

Disputed · 9.6 NVD

Severity by source

Sources disagree (Medium–Critical)

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 17:26 vuln.today

CVSS changed

Jun 05, 2026 - 17:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

CRITICAL 9.6

DescriptionCVE.org

Insufficient validation of untrusted input in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page processed by the codec subsystem. The flaw requires user interaction (visiting a malicious page) and a prior renderer compromise, but if chained successfully it enables full code execution on the host with a scope change. No public exploit identified at time of analysis and EPSS probability is very low (0.05%), but the 9.6 CVSS reflects the high impact of a successful sandbox escape.

Technical ContextAI

The vulnerability resides in Chrome's Codecs component, which handles decoding of media and image formats embedded in HTML content. The root cause is CWE-20 (Improper Input Validation): the codec parser does not adequately validate untrusted bytes from the renderer, allowing a renderer-resident attacker to craft input that crosses the sandbox boundary into a higher-privileged Chrome process. Chrome's multi-process architecture relies on the renderer being a low-privilege, sandboxed process; codec parsing logic that bridges renderer and browser/GPU process is a recurring sandbox-escape surface. The affected product per ENISA EUVD is Chrome builds below 149.0.7827.53; no CPE strings were provided in the input.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - update Chrome Stable on all desktop platforms to this version or later via the built-in updater or managed deployment tooling, then restart the browser to load the new binary; details are in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and the Chromium issue tracker at https://issues.chromium.org/issues/500293394. For Chromium-derived browsers (Edge, Brave, Opera, Vivaldi), apply the corresponding vendor update once it ships with the merged Chromium fix. Until patched, compensating controls include enforcing Chrome's Site Isolation (enabled by default on desktop) to limit cross-site renderer compromise blast radius, restricting users from browsing untrusted sites via enterprise URL allowlists (trade-off: breaks general web usage), and deploying EDR rules that flag unexpected child processes spawned by Chrome's browser process - none of these reliably block the underlying bug, so patching is the only durable fix.