What is the CVSS score of CVE-2026-11102?

CVE-2026-11102 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-11102?

Google Chrome desktop versions before 149.0.7827.53 contain an arbitrary code execution vulnerability (CVE-2026-11102, CVSS 8.8) in the Isolated Web Apps component that executes when users open…. A patch is available.

How to fix or mitigate CVE-2026-11102?

Within 24 hours: Inventory Chrome versions across managed endpoints; identify all devices running version 149.0.7827.52 or earlier. Within 7 days: Deploy Google Chrome 149.0.7827.53 or later via MDM/auto-update policy; prioritize business-critical and customer-facing systems. Within 30 days: Verify 100% deployment compliance; reinforce user training on risks of opening files from untrusted sources.

Google Chrome CVE-2026-11102

EUVD-2026-34563 HIGH

Use of Function with Inconsistent Implementations (CWE-474)

2026-06-04 chrome-cve-admin@google.com

GHSA-qmv8-5r2w-3px8

Google RCE Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Red Hat

8.8 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 01:52 vuln.today

CVSS changed

Jun 06, 2026 - 01:52 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Isolated Web Apps in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a malicious file. (Chromium security severity: Medium)

AnalysisAI

Arbitrary code execution within the Chrome sandbox affects Google Chrome desktop builds prior to 149.0.7827.53 due to an inappropriate implementation in the Isolated Web Apps (IWA) component. A remote attacker who convinces a user to open a malicious file can execute code confined to the sandbox process, with no public exploit identified at time of analysis and an EPSS score of only 0.03% (10th percentile) indicating low predicted exploitation likelihood. Google has shipped a fix in the stable channel update for desktop.

Technical ContextAI

Isolated Web Apps are a Chromium feature designed to package web applications with stronger isolation guarantees and elevated platform capabilities, relying on a bundled signed web bundle format and a dedicated process model distinct from regular web origins. The flaw lies in how Chrome's IWA implementation handles a malicious file, allowing the attacker's payload to run inside the renderer/IWA sandbox process - code execution is therefore constrained by Chrome's multi-process sandbox and would normally require a separate sandbox escape bug to achieve full host compromise. No CWE was assigned by NVD, but the wording 'inappropriate implementation' is Chrome's standard label for logic-flaw classes rather than memory corruption, and the affected component is identified via CPE cpe:2.3:a:google:chrome:*.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - update Chrome via the built-in updater or by redeploying managed installers, then restart the browser so the new binaries take effect, per the advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. For fleets that cannot patch immediately, disable the Isolated Web Apps feature via enterprise policy (IsolatedWebAppInstallForceList left empty and the IsolatedWebAppsEnabled / chrome://flags/#enable-isolated-web-apps trial turned off) to remove the affected surface, accepting that any legitimately deployed IWA-packaged internal applications will stop working; additionally, instruct users not to open untrusted files via the browser and consider tightening email/web gateway file-type filtering to reduce the chance of the malicious-file delivery vector. Track downstream Chromium-based browsers (Edge, Brave, Opera) for their respective security updates incorporating the same fix.