What is the CVSS score of CVE-2026-11207?

CVE-2026-11207 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11207?

A critical vulnerability (CVSS 9.6) in Google Chrome's Autofill component allows remote attackers to escape the browser sandbox and execute arbitrary code through specially crafted network traffic,…. A patch is available.

How to fix or mitigate CVE-2026-11207?

24 hours: Inventory Chrome deployments across corporate endpoints and test Chrome 149.0.7827.53 or later in staging environment. 7 days: Deploy Chrome 149.0.7827.53 or later enterprise-wide using standard patch management channels; prioritize developer workstations and client-facing systems. 30 days: Verify 100% deployment completion and confirm no vulnerable Chrome versions remain in active use.

Google Chrome CVE-2026-11207

EUVD-2026-34668 CRITICAL

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-x7hm-96xq-g364

Information Disclosure Google

Critical

Disputed · 9.6 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 15:22 vuln.today

CVSS changed

Jun 05, 2026 - 15:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

CRITICAL 9.6

DescriptionCVE.org

Insufficient validation of untrusted input in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via malicious network traffic. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 149.0.7827.53 allows remote attackers to break out of the browser's renderer sandbox by sending malicious network traffic processed by the Autofill component. The flaw is rated CVSS 9.6 due to scope change and high impact across confidentiality, integrity, and availability, though Chromium itself assigns it Medium severity and EPSS exploitation probability is currently very low (0.05%). No public exploit identified at time of analysis, but a vendor-released patch is available.

Technical ContextAI

The vulnerability resides in Chrome's Autofill subsystem, the browser feature responsible for parsing and suggesting saved form data (addresses, payment cards, credentials) during form interactions. The root cause is classified as CWE-20 (Improper Input Validation), meaning untrusted input arriving via network traffic is not adequately validated before being processed by Autofill logic. Because the CVSS vector indicates a scope change (S:C), successful exploitation crosses the renderer sandbox boundary - typically meaning the bug allows code or memory effects to influence components outside the constrained renderer process, which is the hardened security boundary Chromium relies on for defense in depth. The affected codebase is Chromium-based Chrome desktop builds prior to 149.0.7827.53.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 or later - update via the built-in updater (chrome://settings/help) or push the new version through enterprise management (Chrome Browser Cloud Management, Group Policy, Jamf, Intune). Administrators of downstream Chromium browsers should monitor their respective vendors for rebased releases incorporating the fix. As a temporary compensating control while patching is rolled out, Autofill can be disabled organization-wide via the AutofillAddressEnabled and AutofillCreditCardEnabled policies (trade-off: users lose form auto-completion convenience for addresses and payment data), and aggressive site-isolation and strict network egress filtering reduce - but do not eliminate - the attack surface. Reference the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for the official update guidance.