What is the CVSS score of CVE-2026-11110?

CVE-2026-11110 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11110?

Yes, a patch is available for CVE-2026-11110. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11110

EUVD-2026-34571 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-06-04 chrome-cve-admin@google.com

GHSA-grjr-m887-79f2

Information Disclosure Google

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Red Hat

7.4 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 04:29 vuln.today

CVSS changed

Jun 06, 2026 - 04:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's ANGLE graphics subsystem (prior to 149.0.7827.53) allows a remote unauthenticated attacker to read sensitive data from other web origins by enticing a user to visit a crafted HTML page. The root cause is an uninitialized memory use (CWE-457) within ANGLE, Chrome's graphics translation layer, which may expose stale memory contents - potentially including data from other browser contexts or origins. No public exploit code or CISA KEV listing has been identified; EPSS probability of 0.03% (11th percentile) indicates low real-world exploitation pressure at time of analysis.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is the open-source graphics abstraction library embedded in Google Chrome that translates OpenGL ES API calls into the host system's native graphics API (Direct3D on Windows, Metal on macOS, Vulkan or desktop OpenGL on Linux). CWE-457 (Use of Uninitialized Variable) describes a condition where a memory buffer or variable is read before being explicitly initialized, causing it to contain stale or residual data from prior memory allocations. In a browser context, uninitialized GPU-adjacent memory may retain fragments of previously rendered content from different web origins, making this class of bug particularly dangerous for cross-origin data leakage - circumventing the browser's Same-Origin Policy at the graphics layer rather than at the JavaScript or DOM level. The affected product is confirmed as Google Chrome desktop releases prior to version 149.0.7827.53, per the EUVD affected version record and the Google Chrome Releases advisory.

RemediationAI

The primary remediation is to update Google Chrome to version 149.0.7827.53 or later, which contains the vendor-released patch for this vulnerability. The update is available via Chrome's built-in auto-update mechanism or by downloading from the official Google Chrome release channel documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. For organizations unable to immediately deploy the patch, a compensating control is to disable or restrict access to WebGL and GPU-accelerated graphics features via enterprise policy (e.g., Chrome's 'WebGLEnabled' and 'GpuProcessEnabled' group policy settings), which reduces the ANGLE attack surface at the cost of breaking WebGL-dependent web applications. Additionally, enforcing strict Content Security Policy headers on internally hosted web properties limits the scope of attacker-controlled HTML that could reach user browsers. No workaround fully eliminates the risk without patching.