What is the CVSS score of CVE-2026-11113?

CVE-2026-11113 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11113?

Google Chrome contains a sandbox escape vulnerability (CVE-2026-11113) in versions before 149.0.7827.53 that could allow attackers to break out of browser isolation and access host system resources.. A patch is available.

How to fix or mitigate CVE-2026-11113?

Within 24 hours: Identify all systems running Chrome versions prior to 149.0.7827.53 and assess exposure scope. Within 7 days: Deploy Chrome version 149.0.7827.53 or later across all affected systems via patch management, prioritizing high-value and sensitive-data environments. Within 30 days: Verify patch deployment completion and monitor Chrome update logs for compliance.

Google Chrome CVE-2026-11113

EUVD-2026-34574 CRITICAL

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-m2r2-wgfq-rqw4

Information Disclosure Google Chrome

Critical

Disputed · 9.6 NVD

Severity by source

Sources disagree (Medium–Critical)

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Red Hat

9.0 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 01:52 vuln.today

CVSS changed

Jun 06, 2026 - 01:52 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:17 nvd

CRITICAL 9.6

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 149.0.7827.53) allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. The CVSS 9.6 score reflects the scope-changing impact (S:C) from renderer to host context, though Chromium itself rates this Medium severity and no public exploit identified at time of analysis. EPSS is very low at 0.05%, suggesting limited near-term mass exploitation despite the high CVSS.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's translation layer that maps WebGL and other GPU API calls to the underlying platform graphics stack (Direct3D on Windows, Metal on macOS, OpenGL/Vulkan on Linux). It runs in a privileged GPU process and is reachable from the less-privileged renderer process via Mojo IPC. The root cause is CWE-20 (Improper Input Validation): ANGLE accepts data from the renderer without sufficient validation, allowing a compromised renderer to send malformed graphics commands that corrupt state in the more privileged process, enabling sandbox escape. The affected component is the Chrome browser identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 or later via the Stable channel update announced at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html; restart the browser after the update completes so the new ANGLE library is loaded. For managed fleets, push the update through your enterprise management channel (Group Policy, Jamf, Workspace) and verify version compliance. As a temporary compensating control until patches are deployed, administrators can disable WebGL via the WebGLEnabled enterprise policy or chrome://flags, which significantly reduces ANGLE's renderer-facing attack surface but breaks legitimate 3D content, games, and some mapping/visualization sites. Bug tracker context is available at https://issues.chromium.org/issues/500560764 and the EUVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-11113.