What is the CVSS score of CVE-2026-11167?

CVE-2026-11167 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11167?

Google Chrome on Android versions prior to 149.0.7827.53 contain a critical sandbox escape in WebView that allows attackers to break out of the browser sandbox if the renderer process is already…. A patch is available.

How to fix or mitigate CVE-2026-11167?

Within 24 hours: Scan mobile device inventory (MDM/EMM) to identify Chrome versions <149.0.7827.53 on Android devices. Within 7 days: Push Chrome update to version 149.0.7827.53 or later via Google Play managed deployment or device policy; enable automatic updates if not already active. Within 30 days: Audit patch deployment success rates and close any devices unable to update.

Google Chrome CVE-2026-11167

EUVD-2026-34628 CRITICAL

Execution with Unnecessary Privileges (CWE-250)

2026-06-04 chrome-cve-admin@google.com

GHSA-rjwc-5x92-9qg7

Privilege Escalation Google

Critical

Disputed · 9.6 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 18:29 vuln.today

CVSS changed

Jun 05, 2026 - 18:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

CRITICAL 9.6

DescriptionCVE.org

Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome on Android prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the WebView sandbox via a crafted HTML page. The flaw stems from an inappropriate implementation in WebView and is chained behind a prior renderer compromise, requiring user interaction. No public exploit identified at time of analysis, and EPSS sits at 0.03% (10th percentile), indicating no current evidence of widespread exploitation despite the high CVSS score of 9.6.

Technical ContextAI

The vulnerability resides in Chrome's WebView component on Android, which embeds the Chromium rendering engine into native Android apps. Chrome uses a multi-process architecture where untrusted web content runs inside a sandboxed renderer process isolated from the host operating system; a sandbox escape allows code in that renderer to access resources outside its intended trust boundary. The CWE-250 classification (Execution with Unnecessary Privileges) points to WebView code paths performing operations with privileges higher than required, enabling an already-compromised renderer to cross the sandbox boundary into the more privileged browser or app process via a specially crafted HTML page.

RemediationAI

Vendor-released patch: Google Chrome for Android 149.0.7827.53. Update Chrome and the Android System WebView component to 149.0.7827.53 or later through Google Play, as detailed in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. For managed Android fleets, push the update via MDM and verify the WebView package version on devices, since some apps load WebView dynamically and remain vulnerable until both Chrome and the system WebView component are updated. As a compensating control until patching completes, restrict use of in-app WebView-based browsing and untrusted HTML content rendering - accepting the trade-off that some apps depending on embedded web content will lose functionality.