What is the CVSS score of CVE-2026-11131?

CVE-2026-11131 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11131?

Google Chrome on Android versions prior to 149.0.7827.53 contains a critical vulnerability that could allow malware within the browser to escape its sandbox and access device data and capabilities.. A patch is available.

How to fix or mitigate CVE-2026-11131?

Within 24 hours: Inventory Android devices running Chrome and enable automatic updates via Google Play and mobile device management systems. Within 7 days: Deploy Chrome version 149.0.7827.53 or later to 80% of organizational Android devices. Within 30 days: Complete deployment to all devices and enforce automatic Chrome updates via MDM policy to prevent regression.

Google Chrome CVE-2026-11131

EUVD-2026-34592 CRITICAL

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-973x-rq3w-69hv

Denial Of Service Google Use After Free Memory Corruption

Critical

Disputed · 9.6 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Red Hat

9.0 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 05:24 vuln.today

CVSS changed

Jun 06, 2026 - 05:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:17 nvd

CRITICAL 9.6

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Autofill in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome on Android versions prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a use-after-free bug in the Autofill component. Exploitation requires a victim to load a crafted HTML page and the attacker to already control the renderer, making this a second-stage primitive rather than a single-shot RCE. No public exploit identified at time of analysis and EPSS is very low (0.03%, 11th percentile), but the high CVSS reflects the impact of full sandbox escape on a mobile platform.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's Autofill subsystem on Android. Autofill runs across both the renderer and browser process boundaries, holding references to form and field data structures; freeing an object while a dangling pointer is still reachable lets the attacker reuse that memory with attacker-controlled data and corrupt object vtables or callback pointers. Because the bug is reachable from a compromised renderer and the scope in CVSS is Changed (S:C), successful exploitation crosses the renderer-to-browser sandbox boundary on Android, where the browser process has substantially more privileges than the sandboxed renderer.

RemediationAI

Vendor-released patch: Google Chrome for Android 149.0.7827.53 - upgrade via Google Play Store as soon as the stable channel rollout reaches the device, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Where managed enrollment exists (Android Enterprise / MDM), force the Chrome app update channel to push 149.0.7827.53 or later rather than waiting for user-driven updates. As an interim compensating control on unpatched devices, disabling Chrome's Autofill for forms and payment methods under Settings reduces the attack surface of the vulnerable component at the cost of user convenience for saved addresses, passwords, and payment data; this does not eliminate the underlying use-after-free but removes the most likely trigger paths until the update is installed.