What is the CVSS score of CVE-2026-11130?

CVE-2026-11130 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11130?

Google Chrome versions prior to 149.0.7827.53 contain a critical remote code execution vulnerability (CVE-2026-11130, CVSS 8.8) that could allow attackers to compromise user systems through malicious…. A patch is available.

How to fix or mitigate CVE-2026-11130?

Within 24 hours: Issue urgent communication requiring all employees to update Chrome to version 149.0.7827.53 or later; optionally restrict non-compliant browser usage. Within 7 days: Deploy Chrome 149.0.7827.53 or later organization-wide via your patch management or MDM platform. Within 30 days: Audit all endpoints to verify 100% remediation and confirm zero vulnerable Chrome instances remain in your environment.

Google Chrome CVE-2026-11130

EUVD-2026-34591 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-j2x7-2h8w-jgrj

Google Memory Corruption RCE Use After Free Denial Of Service Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 03:09 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome versions prior to 149.0.7827.53 stems from a use-after-free flaw in the Media component, allowing a remote attacker who can lure a victim to a crafted HTML page to execute arbitrary code within the renderer sandbox. The high CVSS score of 8.8 reflects the severe impact triad (C:H/I:H/A:H), though exploitation requires user interaction (UI:R) and code execution is contained within Chrome's sandbox boundary. There is no public exploit identified at time of analysis, and SSVC indicates no observed exploitation.

Technical ContextAI

The vulnerability is a CWE-416 Use-After-Free in Chrome's Media subsystem, which handles audio/video decoding, playback pipelines, and media stream processing. UAF bugs occur when memory is freed but a dangling pointer is later dereferenced, enabling attackers to manipulate the freed memory region (typically via heap grooming) to control object vtables or function pointers. The Media component is a frequent source of Chromium UAF bugs due to its complex object lifecycle management across multiple threads and processes. Affected builds include Chrome desktop versions before 149.0.7827.53 across all supported platforms based on the Chromium upstream codebase.

RemediationAI

Vendor-released patch: update Google Chrome to 149.0.7827.53 or later via the stable channel, which Google rolls out automatically on browser restart; administrators in managed environments should verify deployment via group policy or MDM reporting and force restarts where update lag is observed. Reference the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for full details. For Chromium-based browsers, apply the corresponding vendor update once published. As a temporary compensating control if patching is delayed, consider disabling autoplay media and restricting access to untrusted sites via web filtering or enterprise policy (URLBlocklist); note the trade-off that disabling media features will break legitimate video/audio sites and is impractical as a long-term mitigation.