What is the CVSS score of CVE-2026-11112?

CVE-2026-11112 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11112?

A critical vulnerability in Google Chrome on Linux (versions before 149.0.7827.53) enables attackers to escape the browser sandbox and compromise entire systems, potentially exposing organizational…. A patch is available.

How to fix or mitigate CVE-2026-11112?

Within 24 hours: Inventory all Linux systems running Chrome and document current versions (check chrome://version). Within 7 days: Deploy Chrome 149.0.7827.53 or later to all identified systems; conduct testing with business-critical applications before full rollout. Within 30 days: Verify 100% patch adoption through security tooling and prepare incident response procedures for any systems that remain unpatched.

Google Chrome CVE-2026-11112

EUVD-2026-34573 CRITICAL

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-3h3m-2wg7-xmc3

Information Disclosure Google

Critical

Disputed · 9.6 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

8.2 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 04:24 vuln.today

CVSS changed

Jun 06, 2026 - 04:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:17 nvd

CRITICAL 9.6

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in Chromoting in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted Chrome Extension. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome on Linux versions prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the Chromium sandbox via a crafted Chrome Extension targeting the Chromoting (Chrome Remote Desktop) component. The flaw is rated CVSS 9.6 due to scope change and full CIA impact, though EPSS exploitation probability is very low (0.05%, 15th percentile) and no public exploit identified at time of analysis. Google has shipped a patch in the stable channel update for desktop.

Technical ContextAI

The vulnerability resides in Chromoting, the Chrome component underpinning Chrome Remote Desktop functionality, on the Linux build of Chrome. The root cause is CWE-20 (Improper Input Validation): Chromoting fails to sufficiently validate untrusted input arriving from a renderer process, which in Chromium's multi-process architecture is normally confined by the sandbox. Because Chromoting runs in a more privileged context (browser/utility process) and accepts IPC-style messages, a malicious Chrome Extension executing inside an already-compromised renderer can supply crafted input that crosses the sandbox boundary, defeating the privilege separation Chromium relies on for its primary security model.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 for Linux - upgrade immediately via the stable channel update documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Enterprise administrators should accelerate Chrome auto-update rollout and verify version pinning policies do not hold endpoints below 149.0.7827.53. As compensating controls until patching completes, restrict installation of Chrome Extensions via the ExtensionInstallAllowlist/ExtensionInstallBlocklist enterprise policies (trade-off: blocks legitimate extension workflows), and consider disabling Chrome Remote Desktop / Chromoting host functionality through policy where remote-desktop features are not business-critical (trade-off: loss of remote-access capability for end users). Downstream Chromium-based browsers should be tracked for their respective patched builds.