What is the CVSS score of CVE-2026-11136?

CVE-2026-11136 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11136?

Google Chrome versions prior to 149.0.7827.53 contain a critical remote code execution vulnerability in the Canvas rendering component, exploitable when users visit malicious web pages.. A patch is available.

How to fix or mitigate CVE-2026-11136?

Within 24 hours: Inventory all Chrome deployments and identify affected versions. Within 7 days: Deploy Chrome 149.0.7827.53 or later across all systems. Within 30 days: Verify 100% patching compliance and implement policies to enforce timely security updates.

Google Chrome CVE-2026-11136

EUVD-2026-34597 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-rg37-6qfj-mcgw

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 03:10 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Canvas in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome versions prior to 149.0.7827.53 allows attackers to execute arbitrary code within the renderer sandbox through a use-after-free flaw in the Canvas component. Exploitation requires a victim to visit a crafted HTML page, and no public exploit has been identified at time of analysis. Google rates this as Medium severity internally despite the CVSS 8.8 score, reflecting the sandbox containment limit.

Technical ContextAI

The vulnerability resides in Chrome's Canvas implementation, the HTML5 2D graphics rendering subsystem within Blink. CWE-416 (Use After Free) indicates the bug stems from memory being referenced after it has been freed, a classic memory corruption pattern in C++ codebases that typically arises from incorrect object lifetime management between JavaScript-exposed Canvas APIs and underlying graphics buffers. Successful exploitation manipulates the freed memory region to gain control of execution flow within the renderer process, which runs inside Chrome's site-isolation sandbox. The Chromium security team rated this Medium internally, suggesting the bug is contained to the renderer and requires a sandbox escape to achieve full system compromise.

RemediationAI

Apply the vendor-released patch by upgrading to Google Chrome 149.0.7827.53 or later via the standard update channel (chrome://settings/help triggers the update check, then restart the browser to complete installation). Enterprise administrators managing Chrome via group policy or MDM should accelerate deployment of the 149.0.7827.53 release referenced in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Users of Chromium-based browsers should watch for their respective vendor updates incorporating this fix. As a compensating control until patching completes, restricting Canvas/JavaScript via enterprise policies such as DefaultJavaScriptSetting=2 on untrusted origins, or routing browsing through a remote browser isolation service, will block the attack vector at the cost of breaking most modern web applications.