What is the CVSS score of CVE-2026-11120?

CVE-2026-11120 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11120?

Google Chrome Enterprise Reporting prior to version 149.0.7827.53 contains a critical sandbox escape vulnerability (CVE-2026-11120, CVSS 9.6) that allows attackers to escalate from browser compromise…. A patch is available.

How to fix or mitigate CVE-2026-11120?

Within 24 hours: Inventory Chrome Enterprise deployments and assess current version status. Within 7 days: Deploy Chrome version 149.0.7827.53 or later enterprise-wide, prioritizing critical systems and user-facing workstations. Within 30 days: Verify 100% deployment completion and confirm successful updates in compliance with patch policy.

Google Chrome CVE-2026-11120

EUVD-2026-34581 CRITICAL

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-3gxh-fqmq-7jgm

Information Disclosure Google Chrome

Critical

Disputed · 9.6 NVD

Severity by source

Sources disagree (Medium–Critical)

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Red Hat

9.0 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 01:53 vuln.today

CVSS changed

Jun 06, 2026 - 01:52 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:17 nvd

CRITICAL 9.6

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in Enterprise Reporting in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome's Enterprise Reporting component prior to version 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. The flaw stems from insufficient input validation (CWE-20) and carries a CVSS 9.6 due to scope change, though no public exploit is identified at time of analysis and EPSS sits at 0.05% (15th percentile).

Technical ContextAI

Google Chrome's multi-process architecture isolates untrusted web content inside a sandboxed renderer process, while privileged operations are mediated by the browser process through IPC. The Enterprise Reporting component is one such privileged surface, intended to relay policy and telemetry data from managed deployments. CWE-20 (Improper Input Validation) here indicates that messages or data crossing the IPC boundary from renderer to the Enterprise Reporting handler are not adequately validated, enabling a compromised renderer to abuse the higher-privilege component and escape the sandbox. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering Chrome desktop builds before 149.0.7827.53.

RemediationAI

Vendor-released patch: Chrome 149.0.7827.53 on the Stable channel - upgrade immediately via the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. For managed fleets, verify auto-update is enabled and force a relaunch via the RelaunchNotification / RelaunchNotificationPeriod enterprise policies to ensure users actually pick up the fix rather than running an outdated cached binary. As a compensating control in environments where the patch cannot be rolled out immediately, consider tightening site isolation and restricting browsing to trusted origins via URLAllowlist/URLBlocklist policies to reduce the chance of an initial renderer compromise that this bug would chain off; disabling Enterprise Reporting is not recommended because doing so removes visibility used by security teams without removing the vulnerable code path on unpatched builds.