What is the CVSS score of CVE-2026-11149?

CVE-2026-11149 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11149?

Google Chrome versions prior to 149.0.7827.53 contain a privilege escalation vulnerability that allows attackers to escape the browser sandbox if the renderer process is already compromised,…. A patch is available.

How to fix or mitigate CVE-2026-11149?

Within 24 hours: Inventory Chrome deployment across endpoints and confirm current version baseline. Within 7 days: Test Google Chrome 149.0.7827.53 or later in staging environment and prepare deployment package. Within 30 days: Deploy Chrome 149.0.7827.53 or later to all endpoints; confirm deployment completion via endpoint management tools.

Google Chrome CVE-2026-11149

EUVD-2026-34610 HIGH

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-r3pf-44p3-v8w5

Privilege Escalation Google

7.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 03:11 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

7.5 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 7.5

DescriptionCVE.org

Insufficient validation of untrusted input in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Privilege escalation in Google Chrome prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page that abuses insufficient input validation in the Extensions component. Google rates the Chromium severity as Medium while NVD assigns CVSS 7.5 (High); no public exploit identified at time of analysis and CISA SSVC reports no observed exploitation.

Technical ContextAI

The flaw resides in Chrome's Extensions subsystem, the browser-resident component that brokers privileged APIs (tabs, cookies, native messaging, file access) on behalf of WebExtensions. The root cause is CWE-20 (Improper Input Validation): data received from the lower-privileged renderer process is not adequately validated by the more-privileged extensions/browser process, allowing the renderer to influence trusted operations. Because Chrome's security model treats the renderer as untrusted and relies on IPC boundaries (Mojo) to keep sandbox escapes hard, a validation gap in Extensions effectively turns a renderer-RCE into a sandbox/privilege escalation - the canonical second stage of a Chrome exploit chain.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - update Stable channel to this build or later via the standard auto-update channel or by forcing a restart from chrome://settings/help; enterprise fleets should push the update via Group Policy, MDM, or Omaha/managed-update tooling and verify rollout through the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chromium-derivative browser users (Edge, Brave, Opera, Vivaldi) should update once their vendors publish a corresponding rebase. As a compensating control until patched, restrict installation of third-party extensions via the ExtensionInstallAllowlist / ExtensionInstallBlocklist enterprise policies and consider enforcing site-per-process and strict Site Isolation to raise the cost of the prerequisite renderer compromise; note these controls reduce, but do not eliminate, exposure because the bug lies in Chrome's own Extensions code path rather than a specific third-party extension. Tracking details are in the upstream Chromium issue at https://issues.chromium.org/issues/501739206.