What is the CVSS score of CVE-2026-11224?

CVE-2026-11224 has a contested CVSS base score of 8.1 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11224?

Google Chrome on Linux prior to version 149.0.7827.53 is vulnerable to remote code execution that could enable network-based attackers to compromise affected systems.. A patch is available.

How to fix or mitigate CVE-2026-11224?

Within 24 hours: Inventory Chrome on Linux deployments and enable automatic updates if not configured. Within 7 days: Deploy Chrome 149.0.7827.53 or later across all affected systems. Within 30 days: Verify 100% patch compliance and audit logs for suspicious activity targeting Chromoting component.

Google Chrome CVE-2026-11224

EUVD-2026-34685 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-8gh4-8775-vjr6

Google Memory Corruption RCE Use After Free Denial Of Service Red Hat Suse Chrome

High

Disputed · 8.1 NVD

Severity by source

Sources disagree (Low–Critical)

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

7.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 05, 2026 - 19:31 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 05, 2026 - 19:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 05, 2026 - 19:22 vuln.today

cvss_changed

CVSS changed

Jun 05, 2026 - 19:22 NVD

8.8 (HIGH) 8.1 (HIGH)

Analysis Generated

Jun 05, 2026 - 15:24 vuln.today

CVSS changed

Jun 05, 2026 - 15:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Chromoting in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Low)

AnalysisAI

Remote code execution in Google Chrome on Linux versions prior to 149.0.7827.53 allows a remote attacker to exploit a use-after-free condition in the Chromoting component via malicious network traffic. The flaw carries a CVSS 3.1 score of 8.1 (high) with no public exploit identified at time of analysis and an EPSS probability of 0.04%, though Google rates the Chromium severity as Low. The vendor has shipped a fix in the stable channel update for desktop.

Technical ContextAI

Chromoting is the underlying remote-desktop technology behind Chrome Remote Desktop, allowing one Chrome/Chromium instance to access another machine over the network. The root cause is CWE-416 (Use After Free), a class of memory-corruption bug where freed heap memory is later dereferenced; in browser components processing untrusted network input, such dangling pointers can be groomed to redirect control flow and achieve arbitrary code execution within the affected process. The affected product is the Linux build of Google Chrome at versions earlier than 149.0.7827.53, with the vulnerable code path reachable through the Chromoting remoting protocol handling.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 (Linux) - upgrade to this version or later via the stable channel, as announced at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. On managed Linux fleets, push the updated Chrome package through your distribution's package manager or enterprise update channel and restart the browser to load the patched binary. As an interim compensating control on hosts that cannot be patched immediately, disable or uninstall the Chrome Remote Desktop host/extension to remove the Chromoting attack surface (trade-off: users lose remote-desktop functionality), and restrict inbound network paths used by Chromoting at the host firewall to trusted peers only. Additional issue tracking is at https://issues.chromium.org/issues/502461760.