What is the CVSS score of CVE-2026-11137?

CVE-2026-11137 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11137?

Yes, a patch is available for CVE-2026-11137. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11137

EUVD-2026-34598 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-06-04 chrome-cve-admin@google.com

GHSA-9vj8-prvx-2qp4

Information Disclosure Google

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 05:29 vuln.today

CVSS changed

Jun 06, 2026 - 05:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Uninitialized memory exposure in Google Chrome's ANGLE graphics library prior to version 149.0.7827.53 enables remote unauthenticated attackers to read potentially sensitive data from browser process memory by luring a victim to a crafted HTML page. The CVSS vector (PR:N/UI:R/C:H) confirms no attacker privileges are required but victim interaction is mandatory - the attack is entirely browser-side and exploits how ANGLE handles graphics state without zeroing memory first. No public exploit code exists and EPSS sits at 0.03% (11th percentile), indicating low observed exploitation interest despite the High confidentiality impact rating.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is the cross-platform graphics abstraction layer embedded in Chromium that translates OpenGL ES calls to platform-native APIs such as Direct3D, Metal, and Vulkan. CWE-457 (Use of Uninitialized Variable) indicates that a graphics-related data structure or buffer within ANGLE is allocated but not fully zeroed before being read or used in a computation. Because process memory may contain residual data from prior allocations - including renderer state, JavaScript heap fragments, or other browser internals - an uninitialized read in a graphics code path can inadvertently surface that data to a malicious page via timing side-channels or direct memory disclosure. Affected versions are all Chrome releases prior to 149.0.7827.53, as confirmed by the EUVD affected version range 'Chrome 149.0.7827.53 < 149.0.7827.53' and the Google Chrome Stable Channel Update advisory.

RemediationAI

The vendor-released patch is Google Chrome 149.0.7827.53, confirmed by the Google Stable Channel Update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Administrators and end users should update Chrome immediately via the browser's built-in updater (Settings → About Chrome) or through enterprise deployment tools such as Google Admin Console or SCCM. For environments where immediate patching is constrained, short-term compensating controls include enforcing Chrome's Site Isolation feature (already enabled by default in recent versions) to limit cross-origin memory exposure, blocking access to untrusted external websites via proxy policy, and deploying browser extensions or enterprise policies that restrict navigation to allow-listed domains. Note that these controls reduce attack surface but do not eliminate the underlying vulnerability - patching to 149.0.7827.53 or later is the only confirmed fix.