What is the CVSS score of CVE-2026-11118?

CVE-2026-11118 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11118?

Google Chrome contains a remote code execution vulnerability (CVE-2026-11118, CVSS 8.8) that allows attackers to execute code within the browser sandbox when users visit malicious websites.. A patch is available.

How to fix or mitigate CVE-2026-11118?

24 hours: Brief leadership, inventory Chrome deployment scope, and establish rollout timeline. 7 days: Deploy Google Chrome 149.0.7827.53 or later across all endpoints via managed update mechanisms; verify completion. 30 days: Audit all systems for patch compliance, confirm zero unpatched instances, and document closure.

Google Chrome CVE-2026-11118

EUVD-2026-34579 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-47p6-3xx4-p3qm

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 03:09 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome's WebRTC component prior to 149.0.7827.53 allows remote attackers to execute arbitrary code within the renderer sandbox when a victim visits a crafted HTML page. The flaw is a use-after-free memory corruption issue rated CVSS 8.8 with high impact across confidentiality, integrity, and availability, though execution remains confined to the sandbox and no public exploit identified at time of analysis.

Technical ContextAI

WebRTC (Web Real-Time Communication) is the browser subsystem that handles peer-to-peer audio, video, and data channels and is implemented in C++ inside Chromium's renderer process. CWE-416 (Use After Free) describes a class of memory corruption where code references a heap object after it has been freed, allowing an attacker who can control the reallocated memory to hijack object virtual tables or function pointers and pivot to arbitrary code execution. WebRTC has historically been a high-value target because it exposes complex parsers and state machines (SDP, RTP, DTLS, ICE) to attacker-controlled web content, expanding the renderer attack surface considerably.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 or later on the Stable channel - update via Chrome's built-in updater (chrome://settings/help) or enterprise tooling, referencing the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and the upstream tracker at https://issues.chromium.org/issues/501424047. Administrators managing Chromium-derived browsers should monitor their respective vendors and apply the equivalent update once published. As a temporary compensating control until patches are deployed, disabling WebRTC via enterprise policy (e.g., WebRtcAllowLegacyTLSProtocols and the WebRtcUdpPortRange / WebRtcLocalIpsAllowedUrls policies, or setting WebRtcIPHandling to disable_non_proxied_udp) reduces exposure, with the trade-off that video conferencing, screen sharing, and voice apps (Google Meet, Teams, Discord, Slack huddles) will break or fall back to TURN; alternatively, blocking outbound STUN/TURN at the network edge and using browser isolation or strict ad/script blocking on untrusted sites narrows the delivery path.