What is the CVSS score of CVE-2026-11151?

CVE-2026-11151 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-11151?

Google Chrome versions prior to 149.0.7827.53 contain a sandbox escape vulnerability affecting the Password Manager component that could allow attackers to elevate privileges from the browser process…. A patch is available.

How to fix or mitigate CVE-2026-11151?

Within 24 hours: Audit deployed Chrome versions and identify systems running pre-149.0.7827.53 releases. Within 7 days: Deploy Chrome 149.0.7827.53 (stable channel) organization-wide via software distribution or auto-update enforcement. Within 30 days: Verify patch completion across all endpoints and review logs for exploitation attempts targeting the Password Manager component.

Google Chrome CVE-2026-11151

EUVD-2026-34612 HIGH

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-89p2-xv59-9v7m

Information Disclosure Google Chrome

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 18:25 vuln.today

CVSS changed

Jun 05, 2026 - 18:22 NVD

7.5 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 7.5

DescriptionCVE.org

Insufficient validation of untrusted input in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome prior to 149.0.7827.53 allows remote attackers who have already compromised the renderer process to break out of the browser sandbox via a crafted HTML page targeting the Password Manager component. The flaw is rated CVSS 7.5 (High) with EPSS at 0.05% (15th percentile) and no public exploit identified at time of analysis, though Google has shipped a patched stable channel release.

Technical ContextAI

The vulnerability resides in Chrome's Password Manager subsystem, which handles credential storage and autofill across the browser's multi-process architecture. Chromium isolates web content within sandboxed renderer processes, and components such as Password Manager run with higher privileges in the browser process to mediate access to stored secrets. The root cause is classified as CWE-20 (Improper Input Validation), meaning untrusted input crossing the renderer-to-browser IPC boundary into Password Manager is not adequately validated, enabling an already-compromised renderer to escalate privileges and escape the sandbox. Affected builds correspond to Chrome desktop versions before 149.0.7827.53 (no specific CPE strings were provided in the input).

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 (Stable channel). Update Chrome to 149.0.7827.53 or later by allowing the built-in auto-updater to apply the Stable channel update and restarting the browser, as documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Enterprises managing Chrome via policy should push the new version through their software distribution system and verify via chrome://settings/help on managed endpoints; users of Chromium-derivative browsers should apply equivalent vendor updates as they become available. As an interim compensating control while patching is rolling out, administrators can disable the built-in Password Manager via the PasswordManagerEnabled enterprise policy (trade-off: users lose autofill convenience and may revert to weaker password reuse) or restrict high-risk browsing through web filtering (trade-off: reduced usability and does not address internal/trusted sites that could host a chained renderer exploit).