What is the CVSS score of CVE-2026-11269?

CVE-2026-11269 has a contested CVSS base score of 7.1 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11269?

Google Chrome is affected by a remote code execution vulnerability in versions prior to 149.0.7827.53 that could expose critical business systems to unauthorized access and data compromise through…. A patch is available.

How to fix or mitigate CVE-2026-11269?

Within 24 hours: Identify all Chrome desktop installations and assess current versions; communicate mandatory patching deadline to stakeholders. Within 7 days: Deploy Chrome 149.0.7827.53 or later to all systems; prioritize business-critical user groups first. Within 30 days: Verify patch deployment across the organization and audit recently installed extensions and browser security logs for suspicious activity.

Google Chrome CVE-2026-11269

EUVD-2026-34730 HIGH

Inclusion of Functionality from Untrusted Control Sphere (CWE-829)

2026-06-05 chrome-cve-admin@google.com

GHSA-x732-wxxw-qf5c

Google RCE Chrome

High

Disputed · 7.1 NVD

Severity by source

Sources disagree (Low–High)

NVD PRIMARY

7.1 HIGH

AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 19:26 vuln.today

CVSS changed

Jun 05, 2026 - 19:22 NVD

7.1 (HIGH)

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 05, 2026 - 00:17 nvd

HIGH 7.1

DescriptionCVE.org

Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker in a privileged network position to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Low)

AnalysisAI

Remote code execution within the Chrome renderer sandbox affects Google Chrome desktop builds prior to 149.0.7827.53, stemming from an inappropriate implementation in the Extensions subsystem. An attacker in a privileged network position can deliver a crafted Chrome Extension that, with user interaction, executes arbitrary code confined to the sandbox. No public exploit identified at time of analysis and EPSS probability is very low (0.01%), but a vendor patch is available.

Technical ContextAI

The flaw resides in Chromium's Extensions subsystem, which manages installation, update, and execution of browser extensions packaged as CRX bundles and governed by the manifest/permission model. The CWE-829 classification (Inclusion of Functionality from Untrusted Control Sphere) indicates the browser improperly trusts or loads extension-controlled content or update payloads sourced from a channel an adjacent-network attacker can influence - for example, an extension update or resource fetch that lacks sufficient integrity validation. Because the resulting code execution is constrained to the sandbox (Scope: Unchanged in the CVSS vector), the attacker gains code execution inside the extension/renderer process rather than on the underlying host, though Chromium itself rates the severity as Low.

RemediationAI

Vendor-released patch: update Google Chrome to 149.0.7827.53 or later on the Stable channel as published in the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html); managed deployments should verify auto-update is enforced and roll the new build through MDM/Group Policy. Users of Chromium-based browsers should apply their respective vendor's update once it incorporates the fixed Chromium baseline. As compensating controls until patching completes, restrict extension installation to an enterprise allowlist via the ExtensionInstallAllowlist/ExtensionInstallForcelist policies (trade-off: blocks legitimate ad-hoc extension use), require employees to avoid untrusted networks or to route through a corporate VPN to neutralize the adjacent-network prerequisite (trade-off: VPN performance and split-tunnel exceptions), and disable developer mode and sideloading via ExtensionDeveloperModeSettings (trade-off: impedes internal extension development workflows).