What is the CVSS score of CVE-2026-11198?

CVE-2026-11198 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11198?

Google Chrome versions before 149.0.7827.53 contain a critical sandbox escape vulnerability that attackers can exploit through malicious video files, potentially giving them complete system access to…. A patch is available.

How to fix or mitigate CVE-2026-11198?

Within 24 hours: Audit all organizational Chrome deployments and document current versions. Within 7 days: Deploy Chrome 149.0.7827.53 or later to all endpoints; enforce updates through mobile device management (MDM) and endpoint management tools for maximum coverage. Within 30 days: Verify 100% patch compliance and monitor endpoint detection and response (EDR) telemetry for exploitation indicators related to this CVE.

Google Chrome CVE-2026-11198

EUVD-2026-34659 CRITICAL

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-w7pf-4g5q-p5j6

Information Disclosure Google

Critical

Disputed · 9.6 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 16:25 vuln.today

CVSS changed

Jun 05, 2026 - 16:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:17 nvd

CRITICAL 9.6

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 149.0.7827.53 allows a remote attacker to break out of the browser's renderer sandbox by serving a crafted video file processed by Chrome's media codec stack. The flaw stems from insufficient validation of untrusted input in the Codecs component and requires the victim to load attacker-controlled video content, but successful exploitation yields cross-origin impact (Scope: Changed) with high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis and EPSS exploitation probability is low (0.05%, 15th percentile), though the 9.6 CVSS rating and sandbox-escape primitive make this a high-priority browser patch.

Technical ContextAI

The vulnerability lives in Chrome's media Codecs subsystem, which decodes container and stream formats (e.g., WebM, MP4, VP8/VP9, AV1) inside Chromium's multi-process architecture. The root cause is CWE-20 (Improper Input Validation): the codec parser accepts malformed or unexpected fields in a crafted video file and reaches a state that lets attacker-controlled data influence execution beyond the renderer's sandbox boundary. Because codec parsing historically runs in privileged-adjacent processes (GPU/media service) and the CVSS scope is Changed, exploitation can cross the security boundary that normally isolates per-origin renderer content from the rest of the browser and host. Affected builds map to Chromium-based Chrome stable prior to 149.0.7827.53; Chromium itself rates the underlying issue Medium, while NVD's 9.6 score reflects the chained sandbox-escape impact.

RemediationAI

Apply the vendor-released patch by upgrading Google Chrome to 149.0.7827.53 or later on all desktop platforms (Windows, macOS, Linux) as published in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html; managed fleets should force the update via group policy or MDM rather than relying on user-initiated relaunches. For Chromium-based downstream browsers, track their respective security channels and apply equivalent builds. As a temporary compensating control until patching completes, deploy enterprise policies to disable autoplay of media from untrusted origins and restrict site permissions for video, and consider routing browsing through endpoints with strong EDR coverage; note these controls degrade media-heavy workflows and do not block exploitation if a user opens a malicious video directly. There is no documented Chrome flag to disable the affected codec parser without breaking legitimate video playback, so patching is the only durable fix.