What is the CVSS score of CVE-2026-11104?

CVE-2026-11104 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11104?

Yes, a patch is available for CVE-2026-11104. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11104

EUVD-2026-34565 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-06-04 chrome-cve-admin@google.com

GHSA-9rf5-w5jw-8vq5

Information Disclosure Google Chrome

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Red Hat

5.7 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 04:27 vuln.today

CVSS changed

Jun 06, 2026 - 04:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Uninitialized memory exposure in the ANGLE graphics layer of Google Chrome prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to read potentially sensitive data from process memory by delivering a crafted HTML page. The vulnerability is limited to confidentiality impact - no code execution or integrity compromise is possible through this vector alone. With an EPSS score of 0.03% (11th percentile), no public exploit code, and no CISA KEV listing, real-world exploitation risk is currently low despite the High confidentiality CVSS sub-score.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Google Chrome's cross-platform abstraction layer that translates OpenGL ES API calls into platform-native graphics APIs (Direct3D on Windows, Metal on macOS, Vulkan elsewhere). CWE-457 (Use of Uninitialized Variable) indicates that a graphics-related data structure or buffer within ANGLE is allocated but not zeroed or otherwise initialized before use, leaving it populated with stale heap or stack contents from prior operations. Because ANGLE operates within the renderer process and handles attacker-influenced content (HTML/WebGL), a compromised renderer can craft calls into ANGLE that trigger reads of this uninitialized memory, exposing fragments of process memory - which may contain cookies, tokens, or other sensitive data resident in that process. The affected product range is Google Chrome versions prior to 149.0.7827.53, as confirmed by the ENISA EUVD entry EUVD-2026-34565.

RemediationAI

Update Google Chrome to version 149.0.7827.53 or later, which contains the vendor-released patch per Google's stable channel update advisory at chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism will deliver this fix to most users automatically; administrators managing enterprise deployments should verify the rollout via Google Update or their MDM solution. No specific workarounds exist to disable ANGLE without broadly disabling hardware-accelerated graphics, which would degrade browser performance. Because exploitation of this specific CVE requires prior renderer process compromise, organizations that have deployed Chrome's site isolation and sandbox hardening features (enabled by default in modern Chrome) already benefit from partial mitigation by limiting the blast radius of renderer compromises in general. No side effects have been reported for upgrading to 149.0.7827.53.