What is the CVSS score of CVE-2026-11143?

CVE-2026-11143 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11143?

Yes, a patch is available for CVE-2026-11143. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11143

EUVD-2026-34604 MEDIUM

Heap-based Buffer Overflow (CWE-122)

2026-06-04 chrome-cve-admin@google.com

GHSA-jjwm-mmf2-4537

Heap Overflow Google Buffer Overflow Chrome

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 05:32 vuln.today

CVSS changed

Jun 06, 2026 - 05:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Out of bounds read in Extensions in Google Chrome on Linux prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory via a crafted Chrome Extension. (Chromium security severity: Medium)

AnalysisAI

Out-of-bounds heap read in Google Chrome's Extensions component on Linux exposes sensitive process memory to a malicious extension author. Affected versions are Chrome on Linux prior to 149.0.7827.53; Windows and macOS are not listed as affected. Exploitation requires convincing a target user to install a crafted malicious extension, limiting exposure compared to the CVSS 6.5 score implies - no public exploit identified at time of analysis, and EPSS of 0.01% (1st percentile) reflects low current exploitation probability.

Technical ContextAI

The vulnerability is rooted in Chrome's Extensions subsystem on Linux, where heap memory is read beyond its allocated bounds during processing of a crafted extension. A notable discrepancy exists between the description ('out of bounds read') and the assigned CWE-122 ('Heap-based Buffer Overflow') - this may indicate the OOB read is triggered by an underlying heap buffer overflow condition, or may reflect an NVD tagging inconsistency. Chrome extensions run in a sandboxed renderer process but interact with privileged browser APIs; a malformed extension can craft API calls or data structures that cause Chrome's extension handling code to dereference memory outside the intended heap allocation, leaking process memory contents. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms the attack surface is network-reachable through extension delivery but mandates user interaction for installation, and scope is unchanged (the leak stays within the Chrome process boundary).

RemediationAI

Update Google Chrome on Linux to version 149.0.7827.53 or later immediately; this is the vendor-released patch confirmed by the Chrome Releases stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome typically auto-updates, but administrators should verify the update has applied by checking chrome://settings/help. As a compensating control prior to patching, enforce extension installation policies to allow only vetted, allowlisted extensions via Chrome Enterprise or group policy - this directly addresses the UI:R installation prerequisite that is required for exploitation. Blocking side-loading of unpacked extensions (disabling Developer Mode in Chrome on managed devices) also reduces attack surface. Note: restricting extensions may impact productivity for users who rely on third-party tools, so evaluate scope before applying broadly.