What is the CVSS score of CVE-2026-11124?

CVE-2026-11124 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-11124?

Google Chrome versions prior to 149.0.7827.53 contain a remote code execution vulnerability in the Skia graphics library that can be exploited through a malicious website visit.. A patch is available.

How to fix or mitigate CVE-2026-11124?

Within 24 hours: Identify all systems running Chrome versions prior to 149.0.7827.53 and assess distribution across the organization. Within 7 days: Deploy Chrome 149.0.7827.53 or later using your standard patch management process, prioritizing systems with access to sensitive data or critical applications. Within 30 days: Verify 100% patch compliance and document remediation in your IT asset management system.

Google Chrome CVE-2026-11124

EUVD-2026-34585 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-06-04 chrome-cve-admin@google.com

GHSA-fh5f-69j7-v92v

Heap Overflow Google Buffer Overflow Chrome Red Hat Suse

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Red Hat

8.8 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 16:22 vuln.today

CVSS changed

Jun 08, 2026 - 16:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Integer overflow in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Heap corruption in Google Chrome versions prior to 149.0.7827.53 stems from an integer overflow in the Skia graphics library that can be triggered by a crafted HTML page. Remote attackers can lure a victim to a malicious web page to potentially achieve arbitrary code execution within the renderer process. No public exploit identified at time of analysis, and EPSS exploitation probability is low at 0.03% (11th percentile), though Chrome rendering bugs historically attract exploit development.

Technical ContextAI

Skia is the open-source 2D graphics library used by Chromium (and downstream by Chrome, Edge, Brave, and other browsers, as well as Android and Flutter) to render geometry, text, and images. CWE-122 (heap-based buffer overflow) here is reached through an integer overflow during a Skia operation: arithmetic on size or dimension values wraps, producing an undersized heap allocation that is then written past its bounds. Because Skia processes attacker-controlled drawing primitives derived from HTML, CSS, Canvas, and image content, a crafted page can steer the overflowed allocation into adjacent heap metadata or object pointers, which is the classic primitive for renderer-process memory corruption in Chrome.

RemediationAI

Vendor-released patch: update Google Chrome to 149.0.7827.53 or later on all desktop platforms, as announced in the June 2026 Stable Channel Update (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html); managed fleets should force-relaunch via the RelaunchNotification policy to ensure the new binary is actually loaded. For Chromium-derived browsers (Edge, Brave, Opera, Vivaldi), apply the vendor build that incorporates the equivalent Skia fix once published. If patching must be delayed, restrict browsing to trusted sites via enterprise URL allowlists and consider enabling Chrome's Site Isolation and strictest Safe Browsing tier - note these reduce, not eliminate, exposure to a renderer memory-corruption bug and may break legitimate sites. Disabling hardware-accelerated 2D canvas or WebGL is not a reliable mitigation because Skia is used across software and GPU rendering paths.