What is the CVSS score of CVE-2026-11103?

CVE-2026-11103 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-11103?

Google Chrome on Windows contains a local privilege escalation vulnerability (CVE-2026-11103) allowing attackers with existing system access to gain elevated permissions and potentially compromise…. A patch is available.

How to fix or mitigate CVE-2026-11103?

Within 24 hours: Identify all Windows systems running Chrome versions prior to 149.0.7827.53. Within 7 days: Deploy Chrome version 149.0.7827.53 or later to all affected systems via standard patch management. Within 30 days: Verify 100% deployment completion and audit local system access controls.

Google Chrome CVE-2026-11103

EUVD-2026-34564 HIGH

Improper Privilege Management (CWE-269)

2026-06-04 chrome-cve-admin@google.com

GHSA-qqjc-r7fp-h3vj

Google Microsoft Privilege Escalation Chrome

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Red Hat

8.2 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 06, 2026 - 13:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 06, 2026 - 13:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 06, 2026 - 13:22 vuln.today

cvss_changed

CVSS changed

Jun 06, 2026 - 13:22 NVD

7.3 (HIGH) 7.8 (HIGH)

Analysis Generated

Jun 06, 2026 - 04:23 vuln.today

CVSS changed

Jun 06, 2026 - 04:22 NVD

7.3 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 7.3

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Installer in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: Medium)

AnalysisAI

Local privilege escalation in Google Chrome on Windows prior to version 149.0.7827.53 allows an attacker with local access to elevate to OS-level privileges by planting a malicious file that the Chrome Installer processes inappropriately. The flaw stems from improper privilege management (CWE-269) in the Installer component and requires user interaction to trigger, with no public exploit identified at time of analysis and an EPSS score of 0.01% indicating very low predicted exploitation likelihood.

Technical ContextAI

The vulnerability resides in the Google Chrome Installer on Windows, which executes with elevated privileges during install or update operations. CWE-269 (Improper Privilege Management) indicates the Installer fails to properly constrain or validate the privileges associated with files it processes - likely involving an attacker-controlled file being read, executed, or loaded in a context where the Installer's elevated token is inherited. Chromium classifies this as Medium severity internally, which typically maps to predictable, locally-exploitable privilege boundary issues rather than novel remote attack surface. The affected component is specific to the Windows installer flow and does not impact the Linux or macOS builds.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 for Windows - upgrade all Windows endpoints to this version or later via the Stable channel update referenced at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Because Chrome auto-updates on relaunch, the practical remediation is ensuring users restart the browser; enterprise administrators using Google Update policies should verify update enforcement and audit pinned/frozen versions. As a compensating control until patching completes, restrict write access to directories the Chrome Installer reads from (typically %TEMP%, %LOCALAPPDATA%\Google\Update, and the user's Downloads folder) by applying tight ACLs and AppLocker/WDAC rules to block unsigned executables from these paths - the trade-off is potential interference with legitimate update flows. No protocol-level or feature-disable workaround is meaningful here since the vulnerable code path is the Installer itself.