What is the CVSS score of CVE-2026-11140?

CVE-2026-11140 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11140?

Yes, a patch is available for CVE-2026-11140. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11140

EUVD-2026-34601 MEDIUM

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-wwcx-35p9-p479

Google Buffer Overflow Chrome

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Red Hat

2.8 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 05:31 vuln.today

CVSS changed

Jun 06, 2026 - 05:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Out of bounds read in Chromecast in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Out-of-bounds read in the Chromecast component of Google Chrome prior to version 149.0.7827.53 enables a remote attacker - who has already compromised the renderer process - to leak potentially sensitive data from process memory by delivering a crafted HTML page. This is a chained vulnerability: exploitation is conditional on a prior renderer compromise, making it a second-stage information-disclosure step rather than a standalone attack. No public exploit code has been identified and EPSS probability stands at 0.05% (15th percentile), consistent with a medium-severity, constrained attack path. Google has released a fix in stable channel 149.0.7827.53.

Technical ContextAI

The vulnerability resides in the Chromecast subsystem of Google Chrome's renderer-side code. CWE-20 (Improper Input Validation) is the assigned root cause class, meaning attacker-controlled input is not properly validated before being used to index or access memory, resulting in a read beyond an allocated buffer boundary - consistent with the 'out of bounds read' description and the 'Buffer Overflow' tag applied by ENISA EUVD-2026-34601. Chrome's multi-process architecture places rendering in a sandboxed renderer process; however, this vulnerability is meaningful only after that sandbox has been breached by a prior exploit. Affected versions are all Google Chrome releases prior to 149.0.7827.53 across desktop platforms, as confirmed by the EUVD affected-version range and the Google Chrome Releases stable channel advisory.

RemediationAI

The primary remediation is to update Google Chrome to version 149.0.7827.53 or later, which contains the vendor-released patch as confirmed by the stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Enterprise environments using managed Chrome deployments should push this update via policy as part of standard patch cycles. Because exploitation requires a prior renderer compromise, organizations that cannot immediately patch should focus on reducing renderer attack surface: enforce Chrome's strict site isolation (--site-per-process, which is default on desktop but verify it is not disabled by policy), disable unnecessary browser extensions that expand attack surface, and restrict browsing to trusted content through URL filtering or proxy allowlists. Blocking access to untrusted or unknown web content is the most effective compensating control given the UI:R requirement and the renderer-compromise prerequisite, though it carries usability trade-offs. No workaround fully replaces patching.