What is the CVSS score of CVE-2026-11208?

CVE-2026-11208 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11208?

Yes, a patch is available for CVE-2026-11208. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11208

EUVD-2026-34669 MEDIUM

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-7fg2-p8pj-m24q

Denial Of Service Use After Free Memory Corruption Google Red Hat Suse Chrome

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 16:36 vuln.today

CVSS changed

Jun 05, 2026 - 16:22 NVD

6.5 (None) 6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Memory information disclosure in Google Chrome's Codecs component affects all desktop versions prior to 149.0.7827.53, enabling remote unauthenticated attackers to read potentially sensitive data from browser process memory when a user visits a specially crafted HTML page. The root cause is a use-after-free (CWE-416) in the media codec subsystem, yielding high confidentiality impact with no integrity or availability consequences per CVSS. EPSS is very low at 0.03% (11th percentile) and SSVC confirms no active exploitation, placing this firmly in the routine patch category despite its Medium severity score.

Technical ContextAI

Use-after-free (CWE-416) is a memory safety vulnerability where a program continues to use a pointer after the memory it references has been freed. In Chrome's Codecs component - responsible for audio and video decoding - the freed memory region may still contain residual sensitive data (e.g., decoded media buffers, or adjacent heap objects holding credentials or tokens) that attacker-controlled HTML can cause the browser to read and potentially expose. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms this is reachable from the network via crafted web content with no special privileges, but requires a user to load the page. All Google Chrome desktop releases (Windows, macOS, Linux) below version 149.0.7827.53 are affected, as indicated by the EUVD affected range and vendor stable-channel release notes.

RemediationAI

The primary fix is upgrading Google Chrome to version 149.0.7827.53 or later, confirmed by the vendor stable-channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome's built-in auto-update mechanism will deliver this patch automatically; administrators should verify that auto-update is not disabled via enterprise policy and prompt users to restart the browser to finalize installation. For environments where immediate patching is not feasible, a practical compensating control is restricting user access to untrusted external web content via a web proxy with category filtering, which limits exposure to attacker-hosted crafted pages - though this carries significant usability trade-offs in general-purpose environments. No feature-level workaround to disable the affected Codecs code path is documented by Google.