What is the CVSS score of CVE-2026-11165?

CVE-2026-11165 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11165?

Google Chrome on iOS users are exposed to a critical sandbox escape vulnerability (CVE-2026-11165) that allows attackers to fully compromise device security by hosting malicious web pages.. A patch is available.

How to fix or mitigate CVE-2026-11165?

Within 24 hours: Identify Chrome usage across iOS devices in your environment using MDM telemetry; issue security alert to all users. Within 7 days: Push Chrome iOS update to version 149.0.7827.53 or later via MDM; establish deadline for patch compliance. Within 30 days: Verify ≥95% patch adoption through mobile device inventory; document any persistent unpatched devices and remediation plan for isolated systems.

Google Chrome CVE-2026-11165

EUVD-2026-34626 CRITICAL

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-3r5f-98jq-rfx6

Denial Of Service Google Use After Free Memory Corruption Apple

Critical

Disputed · 9.6 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

6.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 18:28 vuln.today

CVSS changed

Jun 05, 2026 - 18:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

CRITICAL 9.6

DescriptionCVE.org

Use after free in WebMIDI in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome on iOS before 149.0.7827.53 can be triggered by a remote attacker who lures a user to a malicious HTML page that abuses a use-after-free condition in the WebMIDI subsystem. Successful exploitation breaks out of the renderer sandbox with high confidentiality, integrity, and availability impact, though no public exploit is identified at time of analysis and EPSS probability is very low (0.03%).

Technical ContextAI

WebMIDI is a browser API that lets web content interact with MIDI musical instrument hardware through the renderer process. The flaw is a CWE-416 use-after-free, meaning code paths in the WebMIDI implementation continue to reference an object after it has been freed, allowing memory to be reallocated and re-typed under attacker control. Because the CVSS scope is Changed (S:C), the bug crosses Chrome's sandbox boundary, which on iOS is layered on top of Apple's WebKit/WKWebView process model - Chrome on iOS is required by App Store policy to use WebKit, so the WebMIDI handling and sandbox semantics differ from desktop Blink-based builds, making this iOS-specific.

RemediationAI

Apply the vendor-released patch by upgrading Google Chrome on iOS to 149.0.7827.53 or later via the Apple App Store; MDM-managed fleets should push the update and verify installed versions. Reference the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for distribution timing. As a compensating control until patching completes, restrict use of Chrome on iOS in favor of an already-patched browser, or use MDM web content filtering to block untrusted HTML sources, accepting the trade-off of reduced browsing flexibility; disabling WebMIDI specifically is not user-configurable in Chrome iOS, so feature-level mitigation is not a viable workaround.