What is the CVSS score of CVE-2026-11154?

CVE-2026-11154 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-11154?

Google Chrome versions prior to 149.0.7827.53 contain a sandbox escape vulnerability in the WebGPU implementation that allows an attacker with a compromised browser renderer process to escalate…. A patch is available.

How to fix or mitigate CVE-2026-11154?

Within 24 hours, inventory all endpoints and identify Chrome installations running versions prior to 149.0.7827.53. Within 7 days, deploy Chrome 149.0.7827.53 or later stable channel release to all affected systems via your patch management system, prioritizing user-facing workstations. Within 30 days, verify deployment completion through your endpoint management platform and confirm all systems are running the patched version.

Google Chrome CVE-2026-11154

EUVD-2026-34615 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-p4p7-pc96-m757

Denial Of Service Use After Free Memory Corruption Google Chrome

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.2 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 18:27 vuln.today

CVSS changed

Jun 05, 2026 - 18:22 NVD

7.5 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 7.5

DescriptionCVE.org

Use after free in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 149.0.7827.53 stems from a use-after-free in the Dawn WebGPU implementation, enabling a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. No public exploit identified at time of analysis, and EPSS probability is very low (0.03%), though Google has released a stable channel update addressing the flaw.

Technical ContextAI

Dawn is Chromium's cross-platform implementation of the WebGPU standard, providing GPU-accelerated graphics and compute capabilities to web content by translating WebGPU calls into native graphics APIs (Vulkan, Metal, D3D12). The root cause is CWE-416 (Use After Free), in which memory is referenced after it has been released back to the allocator - typically due to mismatched object lifetime management between the renderer process and the GPU process. Because Dawn handles untrusted GPU command streams that cross the renderer/GPU process boundary, a UAF in this component is particularly dangerous as it sits at the sandbox perimeter where renderer-supplied data is parsed by a more privileged process.

RemediationAI

Vendor-released patch: update Google Chrome to 149.0.7827.53 or later via the Stable channel update documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html; on managed fleets verify auto-update is functioning and force-relaunch browsers to apply the fix. Administrators of downstream Chromium forks (Edge, Brave, Opera, Electron apps) should track their respective vendor advisories and update once rebased builds ship. As an interim compensating control where patching is delayed, WebGPU can be disabled via the chrome://flags/#enable-unsafe-webgpu toggle or the WebGPU enterprise policy, which removes the attack surface entirely at the cost of breaking sites and apps that depend on WebGPU acceleration (increasingly common in 3D, ML inference, and creative tooling). Restricting Chrome's exposure to untrusted sites via site isolation policies and URL allowlists is a partial mitigation but does not address malvertising or compromised legitimate sites.