What is the CVSS score of CVE-2026-11171?

CVE-2026-11171 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11171?

Google Chrome users across the organization are at risk of system compromise through a vulnerability in the browser's rendering engine (CVE-2026-11171).. A patch is available.

How to fix or mitigate CVE-2026-11171?

Within 24 hours: Issue mandatory security alert directing all users to update Chrome immediately and verify automatic updates are enabled. Within 7 days: Confirm completion of Chrome update to 149.0.7827.53 or later across all managed endpoints using device management systems. Within 30 days: Conduct security audit to verify 100% patch coverage and review system logs for exploitation indicators predating the update.

Google Chrome CVE-2026-11171

EUVD-2026-34632 HIGH

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-06-04 chrome-cve-admin@google.com

GHSA-gf33-3xv8-8px2

Google RCE Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 03:12 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Integer overflow in Blink in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome's Blink rendering engine prior to 149.0.7827.53 allows remote attackers to execute arbitrary code within the renderer sandbox by enticing a user to visit a crafted HTML page. The flaw stems from an integer overflow (CWE-472) in Blink and carries a CVSS 3.1 score of 8.8; no public exploit identified at time of analysis, though a vendor patch has been released through the Chrome Stable channel update.

Technical ContextAI

Blink is the open-source rendering engine that Chromium-based browsers (Chrome, Edge, Opera, Brave) use to parse HTML/CSS and drive layout, paint, and DOM execution. The root cause is classified as CWE-472 (External Control of Assumed-Immutable Web Parameter), which in Chromium's context typically manifests when arithmetic on attacker-influenced size or index values wraps around integer bounds, leading to undersized allocations or out-of-bounds memory access during HTML/DOM processing. Because Blink runs inside Chrome's renderer process, successful exploitation is constrained to the sandboxed renderer per the CVSS S:U (unchanged scope) designation, meaning a second sandbox-escape bug would be required to fully compromise the host.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 (Stable channel) - upgrade desktop Chrome immediately via the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html, and force a relaunch since Chrome only applies updates on browser restart. For Chromium-derived browsers (Edge, Brave, Opera, Vivaldi), apply the corresponding vendor build that rebases onto Chromium 149.0.7827.53 or later. As a compensating control until patching is complete, enforce Site Isolation (enabled by default in modern Chrome) and consider deploying enterprise policies that disable JIT in V8 (JavaScriptJitDisabled) or enable Strict Site Isolation; the trade-off is measurable performance degradation on JavaScript-heavy applications. Restricting browsing to a known-good allowlist via web proxy or DNS filtering reduces the attack surface but breaks general web usage and is typically only viable for kiosk or restricted-workstation scenarios.