What is the CVSS score of CVE-2026-11173?

CVE-2026-11173 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11173?

Google Chrome versions prior to 149.0.7827.53 contain a high-severity vulnerability (CVSS 8.8) that could allow code execution within the browser.. A patch is available.

How to fix or mitigate CVE-2026-11173?

Within 24 hours: Inventory Chrome deployment across the organization and notify users to apply updates. Within 7 days: Deploy Chrome version 149.0.7827.53 or later using automated update mechanisms or enterprise deployment tools. Within 30 days: Complete inventory verification and confirm all Chrome instances have been updated to the patched version.

Google Chrome CVE-2026-11173

EUVD-2026-34634 HIGH

Out-of-bounds Write (CWE-787)

2026-06-04 chrome-cve-admin@google.com

GHSA-hx8j-9g3q-7c97

RCE Buffer Overflow Google Memory Corruption

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 03:12 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Out of bounds write in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Out-of-bounds write in the V8 JavaScript engine of Google Chrome prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to execute arbitrary code within the sandbox via a crafted HTML page. The flaw requires user interaction (visiting a malicious page) and prior renderer compromise, and no public exploit identified at time of analysis. CVSS 8.8 reflects high impact across confidentiality, integrity, and availability, though Google classifies the Chromium severity as Medium.

Technical ContextAI

V8 is Chrome's open-source JavaScript and WebAssembly engine, responsible for parsing and JIT-compiling untrusted script content executed inside the renderer process. The root cause is CWE-787 (Out-of-bounds Write), a memory-corruption class typically arising from incorrect bounds checks during type confusion, JIT optimization passes, or object layout assumptions in V8's heap. Exploitation of such bugs commonly leverages crafted JavaScript or WebAssembly to corrupt adjacent objects, gain a read/write primitive, and pivot to arbitrary code execution - though here the impact is bounded by Chrome's renderer sandbox, requiring a separate sandbox-escape chain for full system compromise.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - upgrade immediately via the Stable channel update referenced at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html, and validate that managed endpoints have restarted to load the new binary. For embedders shipping Chromium-derived browsers (Edge, Brave, Opera, Electron, CEF), track downstream releases that incorporate the V8 fix from issue 502337304. As a compensating control until patching completes, enterprises can enforce Site Isolation (already default), disable the V8 optimizer via the --js-flags="--no-opt" command-line switch on high-risk hosts (side effect: substantial JavaScript performance degradation), or restrict browsing to allowlisted internal sites via group policy to reduce exposure to attacker-controlled HTML.