What is the CVSS score of CVE-2026-11213?

CVE-2026-11213 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11213?

Google Chrome prior to version 149.0.7827.53 contains a critical sandbox escape vulnerability that could enable system-level compromise for users whose browser has been previously attacked.. A patch is available.

How to fix or mitigate CVE-2026-11213?

Within 24 hours: Identify all Chrome deployments and versions in use across the organization. Within 7 days: Deploy Chrome 149.0.7827.53 or later via automatic updates and managed deployment tools; prioritize user-facing systems. Within 30 days: Achieve 100% compliance via endpoint telemetry and disable older Chrome versions where possible.

Google Chrome CVE-2026-11213

EUVD-2026-34674 CRITICAL

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-223r-m7gh-jxww

Information Disclosure Google

Critical

Disputed · 9.6 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

8.2 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 15:23 vuln.today

CVSS changed

Jun 05, 2026 - 15:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

CRITICAL 9.6

DescriptionCVE.org

Insufficient validation of untrusted input in Reading Mode in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page that abuses Reading Mode's insufficient input validation. The CVSS 9.6 rating reflects the scope-changing impact (S:C) when chained from a renderer compromise, though EPSS is very low (0.05%) and no public exploit identified at time of analysis. Chromium rates the underlying issue Medium severity, reflecting that prior renderer compromise is a prerequisite.

Technical ContextAI

The flaw resides in Chrome's Reading Mode component, a browser-side feature that reformats web pages into a simplified reader view. The root cause is CWE-20 (Improper Input Validation): Reading Mode does not adequately sanitize untrusted input that reaches it from the renderer process. Because Reading Mode runs in a more privileged context than the sandboxed renderer, malformed HTML passed through this boundary can be processed in a way that escapes the renderer sandbox. This is a classic second-stage Chromium exploit primitive - useful only when chained with a separate renderer-side RCE bug, but valuable to attackers because sandbox escapes are the gating step toward host compromise.

RemediationAI

Update Google Chrome to the vendor-released patch version 149.0.7827.53 or later via the Stable channel; most installations will receive this automatically but enterprise-managed deployments should verify rollout and force update where Chrome auto-update is disabled. Administrators using Google Update or MSI deployments should confirm the new build is pushed across all endpoints, and Chromium-based browsers (Edge, Brave, Opera, Vivaldi) should be monitored for their corresponding downstream releases. Reference the advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. If patching is delayed, a partial compensating control is to disable or restrict the Reading Mode feature via enterprise policy where supported, accepting the usability trade-off for users who rely on that feature; this does not protect against the prerequisite renderer compromise but removes this specific escape path.