What is the CVSS score of CVE-2026-11163?

CVE-2026-11163 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11163?

A critical security flaw in Chrome for Android allows remote attackers to completely bypass the browser's protective sandbox and potentially steal data or install malware on employee devices through…. A patch is available.

How to fix or mitigate CVE-2026-11163?

Within 24 hours: Issue security alert and prepare user communication; within 7 days: deploy Chrome 149.0.7827.53 or later via MDM to all Android devices; within 30 days: verify patch deployment completion and monitor security logs for exploitation indicators.

Google Chrome CVE-2026-11163

EUVD-2026-34624 CRITICAL

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-q9jg-hq52-4qqg

Denial Of Service Use After Free Memory Corruption Google Chrome

Critical

Disputed · 9.6 NVD

Severity by source

Sources disagree (Medium–Critical)

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 18:28 vuln.today

CVSS changed

Jun 05, 2026 - 18:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

CRITICAL 9.6

DescriptionCVE.org

Use after free in Messages in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome on Android prior to 149.0.7827.53 allows remote attackers to break out of the browser's renderer sandbox via a use-after-free in the Messages component triggered by a crafted HTML page. The CVSS vector indicates a scope-changing impact requiring only user interaction (visiting a malicious page), and a vendor patch is available. No public exploit identified at time of analysis and EPSS is low (0.03%), but the sandbox-escape primitive makes this a high-priority browser update.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's Messages subsystem on Android, where memory referenced by a dangling pointer can be reused after it has been freed, yielding attacker-controlled memory layout that can be groomed for arbitrary read/write or control-flow hijack. Because the bug resides in code reachable from rendered HTML and enables a sandbox escape, it crosses the renderer-to-browser-process trust boundary that normally contains web content on Android, where Chrome relies on the Linux/SELinux sandbox and isolatedProcess to constrain compromised renderers. The affected component is Chromium-based Chrome for Android builds prior to 149.0.7827.53, per Google's Stable Channel update.

RemediationAI

Vendor-released patch: Google Chrome for Android 149.0.7827.53 - upgrade via Google Play Store or managed-device MDM channel as soon as practical, referencing the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. No vendor-documented workaround exists for this specific bug; compensating controls until devices are patched include enforcing automatic Chrome updates through Android Enterprise / MDM (trade-off: requires managed devices), restricting browsing to trusted sites via per-app VPN or DNS filtering (trade-off: incomplete coverage and user-experience friction), and advising users to avoid clicking untrusted links since the CVSS vector requires user interaction. Chromium-derivative browsers on Android (Edge, Brave, Samsung Internet, Opera) should also be updated once their upstream rebases land, as they typically inherit such Messages-component fixes.