What is the CVSS score of CVE-2026-11218?

CVE-2026-11218 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-11218?

Google Chrome on Windows (versions prior to 149.0.7827.53) contains a high-severity remote code execution vulnerability that could allow attackers to execute arbitrary code if users open malicious…. A patch is available.

How to fix or mitigate CVE-2026-11218?

Within 24 hours: issue urgent notification to all Windows Chrome users and provide patch information; within 7 days: deploy Chrome version 149.0.7827.53 or later organization-wide through MDM or patch management systems; within 30 days: complete compliance audit across Windows endpoints to verify patch deployment.

Google Chrome CVE-2026-11218

EUVD-2026-34679 MEDIUM

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-jjqm-cjr5-pqhj

RCE Google Microsoft

6.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.8 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

SUSE

MEDIUM

qualitative

Red Hat

9.6 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Severity Changed

Jun 05, 2026 - 19:22 NVD

HIGH MEDIUM

CVSS changed

Jun 05, 2026 - 19:22 NVD

8.1 (HIGH) 6.8 (MEDIUM)

Analysis Generated

Jun 05, 2026 - 15:23 vuln.today

CVSS changed

Jun 05, 2026 - 15:22 NVD

8.1 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.1

DescriptionCVE.org

Inappropriate implementation in PlatformIntegration in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a malicious file. (Chromium security severity: Low)

AnalysisAI

Remote code execution in Google Chrome on Windows prior to version 149.0.7827.53 allows a remote attacker to run arbitrary code when a victim is lured into performing specific UI gestures involving a malicious file delivered through the PlatformIntegration component. The flaw stems from improper input validation (CWE-20) and, while a vendor patch is available, no public exploit has been identified at time of analysis and EPSS scoring (0.04%) indicates very low near-term exploitation probability.

Technical ContextAI

The vulnerability resides in Chrome's PlatformIntegration subsystem, the component that mediates interactions between the Chromium browser process and host operating system features on Windows (file handling, OS shell integration, drag-and-drop, and similar bridging functionality). The root cause is classified as CWE-20 (Improper Input Validation), meaning a malicious file or its associated metadata is not properly validated before being acted upon by Windows-specific platform code. Chromium internally rated the issue as Low severity, suggesting the practical attack surface is constrained by the required UI interaction, even though the cross-process consequences can yield arbitrary code execution.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 for Windows - upgrade immediately via Chrome's auto-update channel or enterprise deployment tooling, then restart the browser to apply (see https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html). Enterprises managing Chrome via group policy should validate that the AutoUpdate and ComponentUpdate policies are not disabled, since pinned older builds will remain exposed. As compensating controls until patching completes, restrict download of untrusted file types via SmartScreen and Windows Attachment Manager policies, enforce 'Open file' warnings, and consider enabling Microsoft Defender Application Guard or Chrome Enterprise Connectors safe-browsing enhanced protection - trade-off is added user friction on legitimate downloads. Avoid blocking PlatformIntegration broadly as it would degrade core browser/OS interoperability (drag-and-drop, file open).