What is the CVSS score of CVE-2026-11231?

CVE-2026-11231 has a contested CVSS base score of 8.1 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11231?

Google Chrome on macOS versions below 149.0.7827.53 contains a remote code execution vulnerability in the Safe Browsing component that could allow attackers to execute arbitrary code if users…. A patch is available.

How to fix or mitigate CVE-2026-11231?

Within 24 hours: Inventory macOS systems with Google Chrome and document current versions. Within 7 days: Deploy Chrome version 149.0.7827.53 or later across all macOS endpoints via MDM or software update mechanism. Within 30 days: Verify patch deployment completion and confirm Safe Browsing feature remains enabled.

Google Chrome CVE-2026-11231

EUVD-2026-34692 HIGH

Code Injection (CWE-94)

2026-06-04 chrome-cve-admin@google.com

GHSA-9mqr-hr5g-5p48

RCE Google Code Injection

High

Disputed · 8.1 Vendor: google

Severity by source

Sources disagree (Low–High)

Vendor (google) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

SUSE

HIGH

qualitative

Red Hat

8.8 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 15:24 vuln.today

CVSS changed

Jun 05, 2026 - 15:22 NVD

8.1 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.1

DescriptionCVE.org

Inappropriate implementation in Safe Browsing in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a malicious file. (Chromium security severity: Low)

AnalysisAI

Remote code execution in Google Chrome on macOS prior to 149.0.7827.53 allows a remote attacker to run arbitrary code by tricking a user into interacting with a malicious file, due to an inappropriate implementation in the Safe Browsing component. No public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.04%, 12th percentile), though the CVSS base score of 8.1 reflects high confidentiality and integrity impact. Chromium internally rated the security severity as Low, suggesting practical exploitability is constrained despite the high CVSS.

Technical ContextAI

The flaw resides in Chrome's Safe Browsing subsystem, which is responsible for warning users about malicious downloads, phishing sites, and unsafe URLs by checking content against Google's threat intelligence lists. The CWE-94 classification (Improper Control of Generation of Code, i.e., Code Injection) indicates that the Safe Browsing component fails to properly constrain how downloaded or referenced file content is handled, allowing attacker-controlled data to influence code execution paths. The affected CPE corresponds to Google Chrome on the macOS platform specifically (per the description), with version 149.0.7827.53 being the fixed release; earlier Chromium-based behavior on macOS apparently differs in download/file-handling enforcement compared to Windows or Linux builds.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 for macOS - upgrade immediately via Chrome's built-in updater or by downloading the stable channel installer, per the advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Enterprise fleets managed via MDM should push the updated package and verify auto-update is enabled. As an interim compensating control for unpatched macOS endpoints, restrict downloads of executable and archive file types via web gateway or endpoint policy and instruct users not to open files from untrusted sources; note that disabling Safe Browsing entirely is counterproductive since it removes other protective checks, and blocking file downloads at the gateway will affect legitimate workflows.