What is the CVSS score of CVE-2026-11152?

CVE-2026-11152 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11152?

Google Chrome versions prior to 149.0.7827.53 contain a critical sandbox escape vulnerability in the WebGPU (Dawn) component that could allow remote code execution on Windows, Mac, and Linux…. A patch is available.

How to fix or mitigate CVE-2026-11152?

Within 24 hours: Issue urgent patch notification to end users and IT teams; block unpatched Chrome versions via group policy if possible. Within 7 days: Deploy Chrome 149.0.7827.53 or later organization-wide using your existing browser management tools or Mobile Device Management (MDM) solutions. Within 30 days: Audit patch compliance and verify no legacy Chrome instances remain on affected versions; monitor endpoint detection and response (EDR) logs for sandbox-escape signatures.

Google Chrome CVE-2026-11152

EUVD-2026-34613 CRITICAL

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-cvmv-r9jc-qjh2

Information Disclosure Google Use After Free Memory Corruption

Critical

Disputed · 9.6 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 18:26 vuln.today

CVSS changed

Jun 05, 2026 - 18:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

CRITICAL 9.6

DescriptionCVE.org

Object lifecycle issue in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome's Dawn (WebGPU) component prior to version 149.0.7827.53 allows a remote attacker to break out of the renderer sandbox by luring a user to a crafted HTML page. The flaw is a use-after-free (CWE-416) object lifecycle bug; no public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.03% (11th percentile). Google rates the underlying Chromium severity as Medium, but the CVSS 3.1 score of 9.6 reflects the scope change inherent to a sandbox escape.

Technical ContextAI

Dawn is Chromium's cross-platform implementation of the WebGPU standard, translating GPU API calls from JavaScript into native graphics APIs (Vulkan, Metal, D3D12). Because Dawn brokers GPU work between the sandboxed renderer and the more privileged GPU process, lifecycle bugs in its object handling can be leveraged to corrupt memory across the trust boundary. CWE-416 (Use After Free) means an object is referenced after its backing memory has been freed, enabling an attacker who can shape heap allocations from JavaScript to redirect execution or read/write attacker-controlled memory inside the GPU process, which historically has been an effective stepping stone to sandbox escape.

RemediationAI

Vendor-released patch: update Google Chrome to 149.0.7827.53 or later via the Stable channel; on managed fleets, force a relaunch through enterprise policy (RelaunchNotification) to ensure the fix is loaded rather than merely downloaded. Administrators of Chromium-based browsers should track their vendor's corresponding release that pulls in the Dawn fix. As a temporary compensating control where patching is delayed, WebGPU can be disabled via the chrome://flags/#enable-unsafe-webgpu setting (set to Disabled) or by enterprise policy, which removes the vulnerable attack surface at the cost of breaking sites that depend on WebGPU acceleration. Refer to the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for the official fix announcement.