What is the CVSS score of CVE-2026-11119?

CVE-2026-11119 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11119?

Google Chrome on Android versions prior to 149.0.7827.53 contain a CRITICAL sandbox escape vulnerability (CVE-2026-11119, CVSS 9.6) that could enable attackers to gain complete device access if the…. A patch is available.

How to fix or mitigate CVE-2026-11119?

Within 24 hours: Identify and inventory all organizational Android devices running Chrome, particularly those with corporate data access. Within 7 days: Deploy Chrome version 149.0.7827.53 or later to all affected devices using your Mobile Device Management (MDM) platform. Within 30 days: Achieve 100% patch coverage, validate deployment through MDM telemetry, and document completion in your vulnerability management system.

Google Chrome CVE-2026-11119

EUVD-2026-34580 CRITICAL

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-6q75-5p92-g2h8

Information Disclosure Google

Critical

Disputed · 9.6 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Red Hat

8.9 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 05:24 vuln.today

CVSS changed

Jun 06, 2026 - 05:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:17 nvd

CRITICAL 9.6

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome on Android prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page that abuses an inappropriate implementation in the GPU component. The flaw requires user interaction (visiting a malicious page) and presupposes a prior renderer compromise, but a successful chain yields full sandbox escape on the mobile platform. No public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.05%, 15th percentile).

Technical ContextAI

The vulnerable component is the GPU process in Chromium on Android, which mediates accelerated graphics operations between renderer processes and the underlying device drivers. CWE-20 (Improper Input Validation) here reflects that the GPU implementation does not adequately validate input received from the renderer, enabling a compromised renderer to influence GPU process behavior in unintended ways. Because Chrome's security model treats the GPU process as a higher-privilege boundary relative to renderers, flaws in this IPC-facing validation are a classic stepping stone for sandbox escape chains on Android, where the renderer is normally confined by SELinux and seccomp policies. Affected builds are Chrome for Android before 149.0.7827.53.

RemediationAI

Upgrade Google Chrome on Android to version 149.0.7827.53 or later via the Google Play Store or managed-device update channels; the vendor-released patch is documented in the Chrome Releases stable-channel announcement at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and tracked in https://issues.chromium.org/issues/501461853. There is no documented configuration-level workaround inside Chrome itself, but because exploitation requires first compromising the renderer via a malicious page, interim compensating controls include enforcing enterprise policies that restrict browsing to allowlisted sites, deploying mobile threat defense / EDR on Android fleets to detect anomalous Chrome child-process behavior, and using MDM to enforce minimum Chrome versions - accepting the trade-off that allowlisting breaks general browsing and MDM enforcement requires managed devices.