What is the CVSS score of CVE-2026-11170?

CVE-2026-11170 has a contested CVSS base score of 8.1 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11170?

Google Chrome on Linux users are vulnerable to a privilege escalation attack through the Chrome Remote Desktop feature, with no public exploit identified at time of analysis.. A patch is available.

How to fix or mitigate CVE-2026-11170?

Within 24 hours: identify all Linux systems running Chrome and those with Chrome Remote Desktop enabled. Within 7 days: deploy Google Chrome version 149.0.7827.53 or later across all affected Linux systems and verify successful installation. Within 30 days: audit Chrome Remote Desktop connection logs for suspicious activity and document patch compliance.

Google Chrome CVE-2026-11170

EUVD-2026-34631 HIGH

Protection Mechanism Failure (CWE-693)

2026-06-04 chrome-cve-admin@google.com

GHSA-hvc5-x4pv-v62q

Google Privilege Escalation Chrome

High

Disputed · 8.1 NVD

Severity by source

Sources disagree (Medium–Critical)

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

10.0 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 18:30 vuln.today

CVSS changed

Jun 05, 2026 - 18:22 NVD

8.1 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.1

DescriptionCVE.org

Inappropriate implementation in Chromoting in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to perform OS-level privilege escalation via malicious network traffic. (Chromium security severity: Medium)

AnalysisAI

OS-level privilege escalation in Google Chrome on Linux prior to 149.0.7827.53 allows remote attackers to escalate privileges via malicious network traffic targeting the Chromoting (Chrome Remote Desktop) component. Google has released a patched stable channel update, and while no public exploit has been identified at time of analysis, the network-based attack vector and high impact across confidentiality, integrity, and availability warrant prompt patching. EPSS probability is very low (0.03%), and the issue is not listed in CISA KEV.

Technical ContextAI

The vulnerability resides in Chromoting, the underlying technology that powers Chrome Remote Desktop, which provides peer-to-peer remote access functionality embedded within Google Chrome on Linux. The CWE-693 (Protection Mechanism Failure) classification indicates that an intended security boundary - in this case, the isolation between Chrome's sandboxed renderer/remoting components and the host operating system - is improperly enforced, allowing malicious network traffic processed by the Chromoting subsystem to break out and escalate privileges at the OS level. Only Linux builds of Chrome before 149.0.7827.53 are affected per the vendor advisory and EUVD record.

RemediationAI

Upgrade Google Chrome on Linux to the vendor-released patch version 149.0.7827.53 or later via the stable channel update documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html; on managed fleets, push the update through your standard Chrome management policy or distribution repository and confirm relaunch so the new binary is loaded. As a compensating control on hosts that cannot be patched immediately, disable Chrome Remote Desktop / Chromoting host components (e.g., stop and mask the chrome-remote-desktop systemd service, or uninstall the Chrome Remote Desktop host package) to remove the vulnerable network attack surface - the trade-off is loss of remote-desktop functionality for users who depend on it. Additionally, restrict inbound network paths to Chromoting on untrusted networks via host firewall rules, accepting that this will not protect against attackers already on the same network segment.