What is the CVSS score of CVE-2026-11239?

CVE-2026-11239 has a contested CVSS base score of 7.5 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11239?

Google Chrome versions prior to 149.0.7827.53 contain a privilege escalation vulnerability in the Extensions subsystem that allows attackers who have already compromised the browser renderer process…. A patch is available.

How to fix or mitigate CVE-2026-11239?

Within 24 hours: Inventory Chrome deployment scope across endpoints and identify deployment mechanisms (GPO, MDM, etc.). Within 7 days: Deploy Chrome version 149.0.7827.53 or later to all affected systems. Within 30 days: Confirm 100% patch deployment completion through vulnerability scanning or endpoint management console; prioritize users with administrative privileges or access to sensitive systems.

Google Chrome CVE-2026-11239

EUVD-2026-34700 HIGH

Improper Input Validation (CWE-20)

2026-06-05 chrome-cve-admin@google.com

GHSA-pmj9-5jq4-f597

Privilege Escalation Google

High

Disputed · 7.5 Vendor: google

Severity by source

Sources disagree (Low–High)

Vendor (google) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.7 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 03:13 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

7.5 (HIGH)

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 05, 2026 - 00:17 nvd

HIGH 7.5

DescriptionCVE.org

Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Privilege escalation in Google Chrome prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to escape sandbox-style restrictions via the Extensions subsystem using a crafted HTML page. The flaw requires user interaction and high attack complexity, and is rated Low severity by the Chromium team despite the 7.5 CVSS score; no public exploit identified at time of analysis.

Technical ContextAI

The vulnerability resides in the Extensions component of the Chromium browser engine, which mediates privileged operations on behalf of installed extensions and enforces process-isolation boundaries between the sandboxed renderer and higher-privilege browser/extension contexts. The CWE-20 (Improper Input Validation) classification, combined with Google's 'inappropriate implementation' wording, indicates that the Extensions code path does not adequately validate state or input coming from the renderer, enabling a compromised renderer to influence extension-mediated logic and gain privileges it should not hold. Affected CPE-equivalent surface is the Chromium-based Google Chrome desktop browser on all platforms prior to the 149.0.7827.53 stable channel build.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - upgrade all Chrome desktop installations to this stable-channel build or later via the official update mechanism documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html, and verify in enterprise fleets via Chrome Browser Cloud Management or GPO-driven update enforcement. For Chromium-based derivatives, apply the corresponding vendor build that incorporates the upstream fix tracked at https://issues.chromium.org/issues/497025738. As a compensating control until patches are deployed, restrict extension installation via the ExtensionInstallBlocklist/Allowlist enterprise policies to reduce the attack surface exposed by the Extensions subsystem (trade-off: breaks any workflow depending on unlisted extensions), and consider hardening sandboxing via site isolation policies already enabled by default in modern Chrome - note that no workaround substitutes for the patch since the flaw is in code that runs regardless of installed extensions.