What is the CVSS score of CVE-2026-11202?

CVE-2026-11202 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-11202?

Google Chrome for iOS (CVE-2026-11202) contains a sandbox escape vulnerability that could allow attackers to gain code execution on user devices through malicious websites.. A patch is available.

How to fix or mitigate CVE-2026-11202?

Within 24 hours: Identify all users running Chrome for iOS; notify them of the security risk; verify availability of Chrome for iOS version 149.0.7827.53 or later. Within 7 days: Deploy Chrome for iOS version 149.0.7827.53 or later to all affected devices via MDM, app store, or direct user notification. Within 30 days: Audit all iOS devices in your inventory to confirm Chrome for iOS is updated to version 149.0.7827.53 or higher; remediate any non-compliant devices.

Google Chrome CVE-2026-11202

EUVD-2026-34663 HIGH

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-2x2v-r3mf-2j25

Information Disclosure Google Apple

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 16:26 vuln.today

CVSS changed

Jun 05, 2026 - 16:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome for iOS prior to 149.0.7827.53 allows a remote attacker who lures a victim to a malicious page to potentially break out of Chrome's renderer sandbox via crafted HTML. The flaw is rated CVSS 8.8 (High) due to high confidentiality, integrity, and availability impact, though Chromium internally classifies severity as Medium and EPSS exploitation probability is currently very low (0.05%). No public exploit identified at time of analysis.

Technical ContextAI

The vulnerability resides in Chrome for iOS, which under Apple's App Store policy is built on WebKit (not Blink/V8) but layers Chromium's process model and UI on top. CWE-20 (Improper Input Validation) indicates that some input - likely a crafted HTML construct, URL handler, or IPC message between renderer and browser process - is not properly validated before being acted upon, enabling a renderer-context attacker to cross sandbox boundaries. On iOS this typically means escaping the WebContent process's sandboxed entitlements to access broader Chrome browser process privileges, though full system compromise is constrained by Apple's underlying iOS sandbox.

RemediationAI

Vendor-released patch: Google Chrome for iOS 149.0.7827.53. Update Chrome on all iOS devices through the App Store to version 149.0.7827.53 or later, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. No workarounds are documented; until updated, users can reduce exposure by avoiding untrusted links in Chrome on iOS or temporarily switching to Safari (which uses the same underlying WebKit engine but a different browser-process surface), accepting the trade-off of losing Chrome sync and features. Enterprise fleets managing iOS devices via MDM should push the Chrome app update and verify version compliance.