What is the CVSS score of CVE-2026-11100?

CVE-2026-11100 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11100?

Google Chrome on macOS versions prior to 149.0.7827.53 contains a critical sandbox escape vulnerability allowing remote code execution via specially crafted websites; no public exploit identified at…. A patch is available.

How to fix or mitigate CVE-2026-11100?

Within 24 hours: Inventory Chrome versions on macOS endpoints. Within 7 days: Deploy Google Chrome 149.0.7827.53 or later to all affected macOS systems. Within 30 days: Verify 100% deployment completion through endpoint management tools.

Google Chrome CVE-2026-11100

EUVD-2026-34561 CRITICAL

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-vgp5-79vf-q8qp

Denial Of Service Use After Free Memory Corruption Google Chrome

Critical

Disputed · 9.6 NVD

Severity by source

Sources disagree (Medium–Critical)

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Red Hat

9.6 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 04:22 vuln.today

CVSS changed

Jun 06, 2026 - 04:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:17 nvd

CRITICAL 9.6

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in File Input in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome on macOS prior to 149.0.7827.53 allows remote attackers to break out of the renderer sandbox via a use-after-free in the File Input component when a victim is lured to perform specific UI gestures on a crafted HTML page. Although Google classified the upstream severity as Medium, the CVSS 3.1 score of 9.6 reflects the scope-change impact of sandbox escape; no public exploit identified at time of analysis and EPSS is very low at 0.03%.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's File Input handling on macOS, the browser feature responsible for rendering and managing <input type="file"> elements and their associated file-chooser dialogs. Use-after-free bugs occur when memory referenced by a dangling pointer is reused after being freed, allowing an attacker who controls the reallocated memory layout to hijack control flow or corrupt object state. Because the bug sits at the boundary between renderer code and the OS file-picker integration, successful exploitation pivots from renderer-confined memory corruption into a sandbox escape, escaping Chrome's per-renderer macOS sandbox profile that normally restricts filesystem and IPC access.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 for macOS - upgrade affected endpoints to this Stable channel build or later via the standard Chrome auto-update mechanism, and verify deployment by checking chrome://settings/help on managed Macs. Enterprises using Google Admin Console or MDM should confirm the Stable channel target version is at or above 149.0.7827.53 and force a relaunch where Chrome has been open for extended periods. The Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html is the authoritative source. As a temporary compensating control prior to update, restrict use of untrusted web content in Chrome on macOS (e.g., via web filtering or browser isolation for high-risk users) and consider disabling file upload workflows on sensitive sites, with the trade-off of breaking legitimate file-upload functionality; there is no documented configuration flag to disable the affected File Input path without disabling file uploads entirely.