What is the CVSS score of CVE-2026-11241?

CVE-2026-11241 has a contested CVSS base score of 8.0 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11241?

A privilege escalation vulnerability in Google Chrome's Cast component (CVE-2026-11241, CVSS 8.0) allows network-adjacent attackers to gain elevated access by directing users to malicious webpages.. A patch is available.

How to fix or mitigate CVE-2026-11241?

24 hours: Identify and inventory all systems with Chrome Cast capability enabled across your infrastructure. 7 days: Deploy Chrome version 149.0.7827.53 or later to all affected systems through your standard change management and patch deployment processes. 30 days: Audit full compliance, document remediation results, and update your vulnerability management records.

Google Chrome CVE-2026-11241

EUVD-2026-34702 HIGH

Improper Input Validation (CWE-20)

2026-06-05 chrome-cve-admin@google.com

GHSA-h7j5-3779-2jpx

Google Privilege Escalation Red Hat Suse Chrome

High

Disputed · 8.0 NVD

Severity by source

Sources disagree (Low–High)

NVD PRIMARY

8.0 HIGH

AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

3.1 LOW

AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Red Hat

7.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 03:19 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.0 (HIGH)

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 05, 2026 - 00:17 nvd

HIGH 8.0

DescriptionCVE.org

Insufficient validation of untrusted input in Cast in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network segment to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Privilege escalation in Google Chrome's Cast component (versions prior to 149.0.7827.53) allows an adjacent network attacker to elevate privileges by delivering a crafted HTML page that exploits insufficient input validation. Exploitation requires the victim to interact with the malicious content, and no public exploit has been identified at time of analysis despite a CVSS score of 8.0. Google has classified the Chromium security severity as Low, suggesting the practical impact is more constrained than the numeric score implies.

Technical ContextAI

The vulnerability resides in Chrome's Cast feature, the subsystem responsible for discovering and streaming content to Google Cast-enabled receivers (Chromecast, smart TVs, Cast-enabled speakers) over the local network, typically using mDNS/DIAL discovery and a WebRTC-style media pipeline. The root cause is classified as CWE-20 (Improper Input Validation), meaning the Cast code path consumes data - likely from a Cast-related message or device response - without sufficiently validating it before acting on it. Because Cast operates within Chrome's renderer/browser process boundary and interacts with local-network devices, flawed validation here can be leveraged by an adjacent attacker who controls or impersonates a Cast endpoint to escape the expected privilege boundary.

RemediationAI

Upgrade Google Chrome to 149.0.7827.53 or later on all desktop platforms; this is the vendor-released patch and is delivered automatically via Chrome's stable channel auto-updater, so the primary action for most environments is to ensure auto-update is enabled and trigger a browser restart to apply pending updates. Confirm rollout via the stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and track the upstream bug at https://issues.chromium.org/issues/497203741. As compensating controls until the patch is applied, disabling the Cast feature via the enterprise policy 'EnableMediaRouter=false' removes the vulnerable code path entirely at the cost of breaking 'Cast to device' functionality for users, and segmenting client devices off untrusted Wi-Fi (e.g., guest/IoT VLAN isolation that blocks mDNS/DIAL traffic to user endpoints) reduces exposure at the cost of also breaking legitimate Cast discovery on those segments. Chromium-derivative browser users should verify their vendor has merged the upstream fix.