What is the CVSS score of CVE-2026-11144?

CVE-2026-11144 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-11144?

Google Chrome versions prior to 149.0.7827.53 contain a critical remote code execution vulnerability in the Media component that attackers can exploit by tricking users into viewing crafted video…. A patch is available.

How to fix or mitigate CVE-2026-11144?

Within 24 hours: audit Chrome deployment footprint across managed and unmanaged endpoints. Within 7 days: deploy Google Chrome 149.0.7827.53 or later through your patch management system, mobile device management (MDM), or browser auto-update mechanisms. Within 30 days: verify 100% coverage via vulnerability scanning and send user communication to BYOD endpoints requiring manual update.

Google Chrome CVE-2026-11144

EUVD-2026-34605 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-4mqj-p59h-v7c8

Google Memory Corruption RCE Use After Free Denial Of Service Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Red Hat

8.8 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 05:25 vuln.today

CVSS changed

Jun 06, 2026 - 05:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted video file. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome's Media component prior to version 149.0.7827.53 allows a remote attacker to trigger a use-after-free via a crafted video file, achieving arbitrary code execution within the renderer sandbox. The flaw requires user interaction (UI:R) such as visiting a malicious page or opening a hostile video, and no public exploit identified at time of analysis. EPSS is very low (0.04%, 12th percentile), but the network-reachable RCE primitive and broad Chrome install base make timely patching essential.

Technical ContextAI

The vulnerability is a CWE-416 Use-After-Free in Chrome's Media stack, which handles parsing and playback of audio/video streams (codecs, demuxers, MediaSource/EME pipelines). Use-after-free occurs when a memory region is dereferenced after being freed, allowing an attacker who controls allocator state to redirect a dangling pointer to attacker-controlled data and hijack control flow. Affected CPE coverage targets Google Chrome desktop builds prior to 149.0.7827.53; because the bug is in the renderer-side media pipeline, successful exploitation yields code execution constrained to Chrome's renderer sandbox, requiring a separate sandbox-escape chain to reach the host OS.

RemediationAI

Vendor-released patch: update Google Chrome to 149.0.7827.53 or later on all desktop platforms via the Stable Channel update referenced at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html, and force-relaunch browsers to apply the fix (Chrome only loads patched binaries after restart). For managed fleets, push the update via Chrome Browser Cloud Management, Group Policy, Jamf, or Intune and verify version compliance. If patching must be delayed, compensating controls include disabling autoplay and blocking untrusted video MIME types at the web proxy (trade-off: breaks legitimate media on intranet/SaaS apps), enforcing Site Isolation and the strictest sandbox flags (already default but verify enterprise policies have not weakened them), and using URL allowlisting to restrict browsing to trusted destinations until the update is deployed. Downstream Chromium-based browsers (Edge, Brave, Opera, Electron apps) must be updated separately once their vendors ship the merge.