What is the CVSS score of CVE-2026-11201?

CVE-2026-11201 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-11201?

A remote code execution vulnerability in Google Chrome (CVE-2026-11201, CVSS 8.8) affects versions prior to 149.0.7827.53 and requires users to install a malicious browser extension to trigger…. A patch is available.

How to fix or mitigate CVE-2026-11201?

Within 24 hours: Audit Chrome versions currently deployed across the organization and identify any systems running versions prior to 149.0.7827.53. Within 7 days: Deploy Chrome 149.0.7827.53 or later to all systems using browser auto-update or managed deployment tools. Within 30 days: Confirm patch coverage exceeds 95%, establish centralized extension policy to block unsigned extensions, and distribute security awareness guidance to users on risks of untrusted extensions.

Google Chrome CVE-2026-11201

EUVD-2026-34662 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-9pgr-9977-jg98

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

7.3 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 16:25 vuln.today

CVSS changed

Jun 05, 2026 - 16:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in ServiceWorker in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome versions prior to 149.0.7827.53 stems from a use-after-free condition in the ServiceWorker component that can be triggered by a malicious browser extension. An attacker who convinces a user to install a crafted Chrome Extension can achieve arbitrary code execution within the renderer context. No public exploit has been identified at time of analysis and EPSS exploitation probability is very low at 0.01%, but the high CVSS score (8.8) reflects the severe potential impact.

Technical ContextAI

The vulnerability resides in Chrome's ServiceWorker implementation, a background script technology defined by the W3C Service Worker specification that enables features like offline support, push notifications, and resource caching by intercepting network requests. The root cause is CWE-416 (Use After Free), a memory corruption class in which freed memory is referenced again, allowing attackers to manipulate heap layout and hijack control flow. Chrome ServiceWorkers run within the browser's multi-process sandboxed architecture, but a successful UAF exploit in this component can still yield code execution within the renderer process, often serving as a stepping stone toward sandbox escape chains. The bug was reported through Google's internal CVE program (chrome-cve-admin@google.com) and tracked in Chromium issue 505068950.

RemediationAI

Vendor-released patch: update Chrome to version 149.0.7827.53 or later via the Stable Channel auto-update mechanism, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Enterprise administrators should verify auto-update is enabled via the ChromeRolloutOverride or RelaunchNotification policies and force a relaunch on managed endpoints. As compensating controls until patching completes, enforce an extension allowlist via the ExtensionInstallAllowlist Chrome enterprise policy to prevent installation of arbitrary extensions (trade-off: blocks legitimate user-requested extensions and requires admin review workflow), or set ExtensionInstallBlocklist to '*' combined with a curated allowlist. Users of Chromium-derived browsers (Edge, Brave, Opera, Vivaldi) should monitor their respective vendor advisories for the corresponding update.