What is the CVSS score of CVE-2026-11141?

CVE-2026-11141 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11141?

Yes, a patch is available for CVE-2026-11141. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11141

EUVD-2026-34602 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-06-04 chrome-cve-admin@google.com

GHSA-6m8g-7xcg-8jj5

Information Disclosure Google

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Red Hat

5.0 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 05:31 vuln.today

CVSS changed

Jun 06, 2026 - 05:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Uninitialized Use in Audio in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Uninitialized memory use in Google Chrome's Audio subsystem (versions prior to 149.0.7827.53) enables an attacker who has already compromised the renderer process to read potentially sensitive data from process memory via a crafted HTML page. This is a chained-exploit component - it does not grant initial access but can assist post-renderer-compromise data leakage or ASLR bypass. No KEV listing and an EPSS of 0.03% (11th percentile) indicate no observed widespread exploitation; no public exploit has been identified at time of analysis.

Technical ContextAI

CWE-457 (Use of Uninitialized Variable) describes a condition where memory is read before it has been explicitly initialized, causing the read to return whatever value previously occupied that memory region - potentially heap artefacts such as pointers, credentials, or cryptographic material. In Chrome's architecture, web content runs inside a sandboxed renderer process isolated from the browser process. The Audio subsystem within this renderer handles media processing; when a crafted HTML page exercises a specific audio code path, uninitialized stack or heap memory is exposed to an already-in-renderer attacker. The affected component is Google Chrome (Chromium-based) on desktop platforms, all versions prior to 149.0.7827.53, as identified by ENISA EUVD-2026-34602 and the vendor's June 2026 stable channel release notes.

RemediationAI

Vendor-released patch: Chrome 149.0.7827.53. Update Google Chrome to version 149.0.7827.53 or later using Chrome's built-in update mechanism (chrome://settings/help) or by deploying the updated installer via enterprise policy. The advisory is published at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. For organizations that cannot immediately update, note that this vulnerability requires a renderer process compromise as a precondition - existing Chrome sandbox controls and Site Isolation features (which are on by default) provide meaningful defense-in-depth. No workaround eliminates the underlying uninitialized memory issue; update is the only definitive fix. Chromium issue tracker reference https://issues.chromium.org/issues/501667839 may provide additional technical detail for downstream Chromium-based browser maintainers who need to backport the fix.