What is the CVSS score of CVE-2026-11116?

CVE-2026-11116 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-11116?

Google Chrome Remote Desktop (Chromoting) in versions before 149.0.7827.53 is vulnerable to remote code execution that could compromise system confidentiality, integrity, and availability.. A patch is available.

How to fix or mitigate CVE-2026-11116?

24 hours: Identify all systems running Chrome Remote Desktop and current versions deployed. Within 7 days: Deploy Chrome 149.0.7827.53 or later enterprise-wide using automated update mechanisms, prioritizing systems with external-facing access. Within 30 days: Validate full patch deployment and monitor logs for any suspicious Chrome Remote Desktop activity.

Google Chrome CVE-2026-11116

EUVD-2026-34577 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-x39c-xjvf-wfg8

Google Memory Corruption RCE Use After Free Denial Of Service Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Red Hat

9.8 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 05:23 vuln.today

CVSS changed

Jun 06, 2026 - 05:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Chromoting in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome versions prior to 149.0.7827.53 is possible through a use-after-free flaw in the Chromoting (Chrome Remote Desktop) component, triggered by malicious network traffic targeting a victim's session. The CVSS 8.8 score reflects high impact across confidentiality, integrity, and availability, though successful exploitation requires user interaction. No public exploit has been identified at time of analysis and EPSS exploitation probability is very low at 0.04%.

Technical ContextAI

The vulnerability resides in Chromoting, the underlying technology powering Chrome Remote Desktop functionality, which handles peer-to-peer remote desktop sessions over the network. CWE-416 (Use After Free) indicates a memory corruption condition where the code continues to reference heap memory after it has been freed, allowing an attacker to manipulate the freed allocation and influence control flow. In browser contexts this class of bug is a frequent pathway to arbitrary code execution within the renderer or related process, often serving as the initial stage of a sandbox escape chain. Google internally rated this Medium severity despite the high CVSS score.

RemediationAI

Vendor-released patch: update Google Chrome to version 149.0.7827.53 or later on the Stable channel, as documented in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Most managed Chrome deployments will receive this through the standard auto-update mechanism; verify that auto-update is not disabled by enterprise policy and force a relaunch to apply the new binary. For environments that cannot patch immediately, a targeted compensating control is to disable or restrict Chrome Remote Desktop usage via the RemoteAccessHostFirewallTraversal and related enterprise policies, or block the relevant Chromoting endpoints at the network egress - the trade-off is loss of remote desktop functionality for users who depend on it. Generic web-content mitigations like Site Isolation provide limited benefit here because the affected component is Chromoting rather than the renderer.