What is the CVSS score of CVE-2026-11211?

CVE-2026-11211 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-11211?

Google Chrome versions prior to 149.0.7827.53 are vulnerable to remote code execution via crafted web pages; exploitation requires user interaction and has negligible near-term likelihood (EPSS…. A patch is available.

How to fix or mitigate CVE-2026-11211?

Within 24 hours: Notify users to update Chrome to version 149.0.7827.53 or later and validate automated update deployment settings. Within 7 days: Confirm update completion across 95%+ of Chrome instances through device management tools. Within 30 days: Achieve 100% compliance and audit logs for exploitation attempts.

Google Chrome CVE-2026-11211

EUVD-2026-34672 HIGH

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-06-04 chrome-cve-admin@google.com

GHSA-5m5w-xxc6-6j93

Google RCE Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Red Hat

8.8 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 13:22 vuln.today

CVSS changed

Jun 06, 2026 - 13:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Integer overflow in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome versions prior to 149.0.7827.53 stems from an integer overflow in the V8 JavaScript engine that allows a remote attacker to execute arbitrary code within the renderer sandbox via a crafted HTML page. The flaw requires user interaction (visiting a malicious page) and currently has no public exploit identified at time of analysis, with an EPSS score of 0.04% indicating very low near-term exploitation probability. Chromium rates the security severity as Medium despite the 8.8 CVSS score, and SSVC indicates no observed exploitation though technical impact is total.

Technical ContextAI

The vulnerability resides in V8, Chrome's open-source JavaScript and WebAssembly engine that compiles and executes JS code from web pages. CWE-472 (External Control of Assumed-Immutable Web Parameter) is the classified weakness type, though the description points to an integer overflow - a numeric calculation producing a value outside the representable range, which in V8 typically leads to undersized buffer allocations, out-of-bounds reads/writes on typed arrays or JIT-compiled code, and ultimately memory corruption exploitable for code execution. Because V8 is also embedded in Chromium-derivative browsers (Edge, Brave, Opera, Vivaldi) and Electron-based applications, downstream products inherit the same defect until they uptake the upstream fix. The execution is bounded by the Chrome renderer sandbox, meaning a successful exploit yields code execution inside the sandboxed renderer process rather than full host compromise without a separate sandbox escape.

RemediationAI

Upgrade Google Chrome to version 149.0.7827.53 or later on the Stable desktop channel - the vendor-released patch is referenced in the Chrome Releases blog post (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html) and tracked in Chromium issue 506629455. For most users Chrome's auto-update mechanism delivers this on restart; enterprise fleets using managed update policies should confirm the rollout reached endpoints and force a relaunch where users defer restarts. Users of Chromium-derivative browsers (Edge, Brave, Opera, Vivaldi) and Electron apps should track the respective vendor advisories for the V8 rebase. As a compensating control until patching, restrict browsing to trusted sites via enterprise policy or URL filtering, or enable Chrome's Site Isolation and Enhanced Safe Browsing - note that disabling JavaScript site-wide would mitigate V8 exposure but breaks most modern web applications and is impractical for general use.