What is the CVSS score of CVE-2026-11111?

CVE-2026-11111 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-11111?

Google Chrome memory leak vulnerability (CVE-2026-11111) could expose sensitive user data when employees visit a crafted webpage.. A patch is available.

How to fix or mitigate CVE-2026-11111?

24 hours: Issue urgent update notification and verify auto-update mechanisms are functional; assess Chrome deployment footprint. 7 days: Deploy Chrome version 149.0.7827.53 or later through your standard endpoint patch management process. 30 days: Verify deployment completion and remediate any non-compliant systems.

Google Chrome CVE-2026-11111

EUVD-2026-34572 HIGH

Out-of-bounds Read (CWE-125)

2026-06-04 chrome-cve-admin@google.com

GHSA-vpg8-9wjj-75x2

Buffer Overflow Information Disclosure Google

8.1

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Red Hat

4.3 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 04:24 vuln.today

CVSS changed

Jun 06, 2026 - 04:22 NVD

8.1 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.1

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Out of bounds read in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Out-of-bounds memory read in the ANGLE graphics translation layer of Google Chrome before 149.0.7827.53 allows a remote attacker to leak adjacent memory contents when a victim visits a crafted HTML page. No public exploit identified at time of analysis, and EPSS rates exploitation probability at just 0.03%, but the CVSS 8.1 score reflects the user-interaction-only barrier combined with high confidentiality and availability impact. Google has shipped a stable-channel fix and Chromium rates the underlying severity as Medium.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is the abstraction library Chrome uses to translate OpenGL ES API calls into the host platform's native graphics API (Direct3D on Windows, Metal on macOS, Vulkan/OpenGL on Linux), and it underpins WebGL rendering in the renderer process. The flaw is classified as CWE-125 (Out-of-Bounds Read), meaning a parser or shader/buffer handler in ANGLE reads past an allocated buffer boundary, exposing uninitialized or adjacent process memory. Because ANGLE runs inside the sandboxed renderer, primary impact is information disclosure (potentially including pointers useful for ASLR bypass) and renderer instability rather than direct sandbox escape.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - update Chrome desktop to 149.0.7827.53 or later via the built-in updater (chrome://settings/help) and relaunch the browser, as documented in the Stable Channel update at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and tracked in Chromium issue https://issues.chromium.org/issues/500530720. Managed environments should push the update through enterprise tooling (Group Policy, Jamf, Intune, or Google Admin console) and verify version compliance. Until rollout completes, a compensating control is to disable hardware-accelerated WebGL by toggling chrome://flags/#disable-webgl or via the WebGLAllowed enterprise policy set to false, which neutralizes the ANGLE attack surface at the cost of breaking 3D content, map renderings, and some video acceleration; for downstream Chromium browsers (Edge, Brave, Opera, Vivaldi), apply the equivalent vendor update once they rebase onto a Chromium ≥149.0.7827.53.