What is the CVSS score of CVE-2026-11256?

CVE-2026-11256 has a contested CVSS base score of 8.3 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11256?

Google Chrome versions prior to 149.0.7827.53 contain a sandbox escape vulnerability that could allow attackers to break out of the browser security boundary if the renderer process is already…. A patch is available.

How to fix or mitigate CVE-2026-11256?

Within 24 hours: Identify all Chrome deployments across endpoints and applications accessing corporate resources. Within 7 days: Deploy Chrome 149.0.7827.53 or later through your endpoint management platform to all affected systems. Within 30 days: Verify successful deployment across all endpoints and establish browser update policies to achieve rapid patching for critical security fixes.

Google Chrome CVE-2026-11256

EUVD-2026-34717 HIGH

Out-of-bounds Read (CWE-125)

2026-06-05 chrome-cve-admin@google.com

GHSA-ccp5-cv37-gvv9

Buffer Overflow Information Disclosure Google

High

Disputed · 8.3 Vendor: google

Severity by source

Sources disagree (Low–High)

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

6.5 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 12:25 vuln.today

CVSS changed

Jun 05, 2026 - 12:22 NVD

8.3 (HIGH)

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 05, 2026 - 00:17 nvd

HIGH 8.3

DescriptionCVE.org

Integer overflow in GPU in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Sandbox escape in Google Chrome's GPU process prior to version 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page that triggers an integer overflow. The flaw, tagged as a buffer overflow with information disclosure potential, requires user interaction and a chained renderer compromise, and no public exploit has been identified at time of analysis despite Chromium rating the underlying severity as Low.

Technical ContextAI

The vulnerability resides in Chrome's GPU process, the privileged component that handles graphics commands forwarded from sandboxed renderers via the Chrome IPC layer. The root cause is classified under CWE-125 (out-of-bounds read), stemming from an integer overflow during size or index calculations in GPU command processing; when the overflow wraps an arithmetic value, subsequent memory operations read or write outside intended buffer boundaries. Because the GPU process runs at a higher privilege level than the renderer sandbox, memory corruption there enables a cross-process sandbox escape, which is reflected in the CVSS Scope:Changed (S:C) attribute.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - upgrade Stable channel Chrome to this version or later as documented in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and tracked in Chromium issue https://issues.chromium.org/issues/498856565. Most installations will receive this automatically via Chrome's background updater; enterprise fleets using GPO or MDM should verify the managed update channel is not pinned to an older version and force a relaunch. As an interim compensating control while patching, disabling hardware acceleration (chrome://settings → System → 'Use graphics acceleration when available' off) routes rendering through the software path and reduces exposure of the vulnerable GPU code, at the cost of degraded WebGL/video performance and higher CPU usage; users of Chromium-derived browsers (Edge, Brave, Opera) should await and apply their respective merged updates.