What is the CVSS score of CVE-2026-11188?

CVE-2026-11188 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-11188?

Google Chrome for Android versions prior to 149.0.7827.53 contain a sandbox escape vulnerability in the USB component that allows remote attackers to bypass device security when users visit a…. A patch is available.

How to fix or mitigate CVE-2026-11188?

Within 24 hours: Inventory the number of Android devices running Chrome versions before 149.0.7827.53, particularly in mobile device management (MDM) systems. Within 7 days: Begin forced deployment of Chrome 149.0.7827.53 or later through MDM or app store configurations for all managed devices. Within 30 days: Verify 100% of managed Android Chrome installations have been updated; configure auto-update enforcement for future security patches.

Google Chrome CVE-2026-11188

EUVD-2026-34649 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-9p4m-hwvx-p3p7

Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 13:23 vuln.today

CVSS changed

Jun 05, 2026 - 13:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in USB in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome for Android before 149.0.7827.53 lets a remote attacker exploit a use-after-free in the USB component by luring a victim to a crafted HTML page, potentially breaking out of the renderer sandbox. CVSS 8.8 reflects the high impact across confidentiality, integrity, and availability, though successful attack requires user interaction (visiting the page). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's USB subsystem (WebUSB) on Android, where freed memory is referenced again, enabling memory corruption that can be steered toward arbitrary code execution or sandbox escape. WebUSB exposes USB device access to web origins through Chromium's IPC-mediated browser/renderer split; a UAF reachable from web content via JavaScript-driven USB API calls can be abused to corrupt browser-process or privileged-process state, undermining the site-isolation sandbox. The affected component is Chromium's USB stack as shipped in Chrome on Android prior to 149.0.7827.53.

RemediationAI

Vendor-released patch: update Google Chrome on Android to 149.0.7827.53 or later via the Google Play Store, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Enterprises managing Android fleets should push the update through MDM and verify rollout, and downstream Chromium-based browsers should be upgraded once they pick up the corresponding Chromium milestone. As a compensating control until patched, restrict or disable WebUSB access using enterprise policy DefaultWebUsbGuardSetting=2 (block) or WebUsbBlockedForUrls to deny chrome://settings exposure of USB device prompts - trade-off is that any legitimate WebUSB-dependent workflows (hardware security keys configuration utilities, developer flashing tools, some kiosk hardware) will break. User-interaction-based mitigation (avoiding untrusted sites) is weak given drive-by delivery is feasible and should not be relied on.