What is the CVSS score of CVE-2026-11108?

CVE-2026-11108 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-11108?

Google Chrome on Android versions prior to 149.0.7827.53 contain a privilege escalation vulnerability that allows attackers to escape the browser sandbox through NFC manipulation when users visit…. A patch is available.

How to fix or mitigate CVE-2026-11108?

Within 24 hours: Inventory all Android devices with Chrome browser and assess user population. Within 7 days: Test Chrome 149.0.7827.53 in non-production environment and prepare deployment plan. Within 30 days: Ensure all Android devices are updated to Chrome 149.0.7827.53 or later through mobile device management (MDM) or user notification.

Google Chrome CVE-2026-11108

EUVD-2026-34569 HIGH

Improper Privilege Management (CWE-269)

2026-06-04 chrome-cve-admin@google.com

GHSA-wv9x-82w2-vvmp

Google Privilege Escalation Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Red Hat

9.6 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 04:23 vuln.today

CVSS changed

Jun 06, 2026 - 04:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in NFC in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Privilege escalation in Google Chrome on Android prior to 149.0.7827.53 allows a remote attacker to escape the browser's normal privilege boundaries by enticing a victim to visit a crafted HTML page that abuses the NFC implementation. The flaw carries a CVSS 8.8 (high) rating with high confidentiality, integrity, and availability impact, though Chromium itself classified its security severity as Medium. EPSS is very low (0.03%, 11th percentile) and there is no public exploit identified at time of analysis.

Technical ContextAI

The vulnerability resides in Chrome's Web NFC implementation on Android, which exposes near-field communication capabilities to web content through the navigator.nfc / NDEFReader APIs. Rooted in CWE-269 (Improper Privilege Management), the issue stems from how Chrome assigns or validates privileges around NFC operations, allowing a web origin to obtain capabilities beyond what its sandboxed context should permit. Because Web NFC is an Android-specific surface in Chrome, the bug does not affect Chrome on desktop platforms; the affected build line is the Chrome for Android stable channel up to 149.0.7827.53.

RemediationAI

Vendor-released patch: Chrome for Android 149.0.7827.53 - upgrade all Android Chrome installations to this version or later via Google Play. Enterprise mobile fleets should verify rollout through MDM-managed app update policies and audit devices still pinned to older builds. As an interim compensating control until devices are updated, administrators can disable Web NFC by pushing the 'DefaultSensorsSetting' / site-level permissions policy via Chrome Enterprise on Android to block NFC API access, accepting the trade-off that legitimate NFC-using web apps will break; alternatively, end users can revoke NFC permissions for untrusted sites in chrome://settings. Reference the Chrome Releases advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and the EUVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-11108 for ongoing updates.