What is the CVSS score of CVE-2026-11158?

CVE-2026-11158 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-11158?

Google Chrome on macOS contains a sandbox escape vulnerability (CVSS 8.6) affecting versions prior to 149.0.7827.53 that could allow local attackers to break out of the browser and access system…. A patch is available.

How to fix or mitigate CVE-2026-11158?

Within 24 hours: Inventory Chrome on macOS deployments and identify systems running versions prior to 149.0.7827.53. Within 7 days: Deploy Chrome 149.0.7827.53 or later to all affected macOS devices via your software distribution mechanism. Within 30 days: Verify deployment completion via endpoint telemetry and document any systems unable to patch for risk assessment.

Google Chrome CVE-2026-11158

EUVD-2026-34619 HIGH

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-g859-48pm-cxfc

Information Disclosure Google Chrome

8.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 18:27 vuln.today

CVSS changed

Jun 05, 2026 - 18:22 NVD

8.6 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.6

DescriptionCVE.org

Insufficient validation of untrusted input in Downloads in Google Chrome on Mac prior to 149.0.7827.53 allowed a local attacker to potentially perform a sandbox escape via a crafted AppleScript command. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome on macOS prior to 149.0.7827.53 allows a local attacker to break out of the browser sandbox via a crafted AppleScript command targeting the Downloads component. The flaw stems from insufficient input validation (CWE-20) and is rated CVSS 8.6 due to scope change and high impact across confidentiality, integrity, and availability. No public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.02% (4th percentile).

Technical ContextAI

The vulnerability resides in Chrome's Downloads subsystem on macOS, where the browser interacts with the operating system's AppleScript automation framework. AppleScript is Apple's inter-process scripting language used to drive applications via Apple Events; Chrome on Mac exposes scriptable handles that must rigorously validate any externally-influenced parameters. The root cause is classified as CWE-20 (Improper Input Validation), meaning Chrome accepted AppleScript-supplied data without enforcing the constraints required to keep operations inside the renderer/browser sandbox. Because the CVSS scope is Changed (S:C), a successful exploit crosses the sandbox boundary and impacts resources controlled by a different security authority - i.e., the host macOS user context outside Chrome's sandbox.

RemediationAI

Vendor-released patch: upgrade Google Chrome on macOS to 149.0.7827.53 or later via the Stable channel update referenced at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html; in managed environments, push the update through MDM (Jamf, Intune for Mac, Kandji) and verify version compliance. As a compensating control until patching completes, restrict AppleScript automation targeting Chrome by using macOS Privacy & Security 'Automation' permissions to deny non-essential apps the ability to send Apple Events to Google Chrome - this blocks the local delivery path but will also break any legitimate workflow that drives Chrome via AppleScript or osascript. Additionally, limit users' ability to execute untrusted .scpt or .applescript files from email or downloads via Gatekeeper and endpoint controls; the trade-off is added friction for power users and admins who rely on macOS automation.