What is the CVSS score of CVE-2026-11146?

CVE-2026-11146 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11146?

Google Chrome versions prior to 149.0.7827.53 contain a sandbox escape vulnerability in the Chromoting component that allows privilege escalation after renderer compromise.. A patch is available.

How to fix or mitigate CVE-2026-11146?

Within 24 hours: Inventory Chrome deployments and establish current version baselines. Within 7 days: Deploy Chrome 149.0.7827.53 to critical systems and high-value endpoints. Within 30 days: Complete organization-wide patching and verify via vulnerability scan.

Google Chrome CVE-2026-11146

EUVD-2026-34607 CRITICAL

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-mgxv-wp8g-q57f

Information Disclosure Google Chrome

Critical

Disputed · 9.6 NVD

Severity by source

Sources disagree (Medium–Critical)

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Red Hat

8.2 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 05:26 vuln.today

CVSS changed

Jun 06, 2026 - 05:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:17 nvd

CRITICAL 9.6

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in Chromoting in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome's Chromoting component prior to version 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. The flaw stems from insufficient input validation (CWE-20) and carries a CVSS 9.6 due to scope change, though Chromium itself rated the severity Medium and EPSS shows only 0.05% exploitation probability with no public exploit identified at time of analysis.

Technical ContextAI

Chromoting is the internal name for the Chrome Remote Desktop subsystem embedded in Google Chrome, which handles remote framebuffer, input, and IPC channels between renderer and browser/privileged processes. The root cause is classified as CWE-20 (Improper Input Validation), meaning data crossing the renderer-to-broker IPC boundary in Chromoting is not adequately sanitized before being processed by a higher-privilege component. Because Chrome's security model relies on the renderer being treated as untrusted, any validation gap on messages crossing the sandbox boundary can enable a compromised renderer to influence privileged code and escape confinement.

RemediationAI

Update Google Chrome to 149.0.7827.53 or later on all desktop platforms - this is a vendor-released patch confirmed via the Chrome Releases stable-channel update for desktop at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html, with the upstream tracker at https://issues.chromium.org/issues/501709220. Because Chrome's auto-update typically lands within hours to days, validate that managed fleets have actually picked up the new build (check chrome://settings/help or enterprise update telemetry) rather than assuming auto-update sufficed. As a compensating control until patching completes, enterprise admins can disable the Chrome Remote Desktop / Chromoting host and client functionality via the RemoteAccessHostFirewallTraversal and RemoteAccessHostClientDomainList enterprise policies, which removes the vulnerable code path at the cost of breaking legitimate Chrome Remote Desktop sessions; site isolation should already be enabled by default and should be confirmed (chrome://flags / SitePerProcess policy) since it raises the cost of the renderer-compromise precondition.