What is the CVSS score of CVE-2026-11125?

CVE-2026-11125 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11125?

Google Chrome versions prior to 149.0.7827.53 contain a use-after-free vulnerability that allows remote code execution within the browser renderer sandbox when users visit attacker-crafted web pages.. A patch is available.

How to fix or mitigate CVE-2026-11125?

Within 24 hours: Issue security notification to all Chrome users and verify auto-update is enabled organization-wide. Within 7 days: Deploy Chrome 149.0.7827.53 or later across all endpoints using MDM/configuration management systems, with priority for executive and high-risk user populations. Within 30 days: Audit and validate Chrome version compliance across all devices; remediate any systems still running vulnerable versions.

Google Chrome CVE-2026-11125

EUVD-2026-34586 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-6w48-v89v-cp2g

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 03:09 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Compositing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome prior to 149.0.7827.53 allows a remote attacker to execute arbitrary code within the renderer sandbox by enticing a user to visit a crafted HTML page that triggers a use-after-free in the Compositing component. The flaw carries a CVSS 8.8 rating and is tagged as RCE/DoS/memory corruption, though no public exploit identified at time of analysis and Google rates the security severity as Medium. Exploitation is constrained to in-sandbox code execution and requires user interaction (visiting the malicious page).

Technical ContextAI

The vulnerability resides in Chrome's Compositing subsystem, which is part of the Blink/Chromium rendering pipeline responsible for layering and compositing graphical elements (layers, paint records, GPU-backed surfaces) before they are rasterized to the screen. CWE-416 (Use After Free) indicates that an object in the compositor's lifecycle is freed while a dangling reference is still reachable; subsequent dereference of that pointer with attacker-controlled heap layout enables arbitrary read/write and eventually code execution in the renderer process. Because the renderer is sandboxed (S:U in the CVSS vector), the immediate impact is confined to the renderer process - a separate sandbox-escape bug would be required to achieve full system compromise.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - update Chrome desktop to this version or later via the built-in updater (chrome://settings/help) or by redeploying the managed MSI/PKG in enterprise environments, per the advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Administrators using Chromium-based browsers should track their vendor's release notes and apply the equivalent updated build as soon as it ships. As a temporary compensating control prior to patch rollout, restrict browsing to trusted sites via enterprise URL allowlists (Chrome's URLBlocklist/URLAllowlist policies) and consider disabling hardware-accelerated compositing through the 'Use hardware acceleration when available' setting or the HardwareAccelerationModeEnabled policy - be aware this materially degrades rendering performance and video playback and does not fully eliminate the compositor code path, so it is at best a partial mitigation.