What is the CVSS score of CVE-2026-11282?

CVE-2026-11282 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

How to fix or mitigate CVE-2026-11282?

Within 24 hours: Inventory Linux systems running Chrome and verify current versions. Within 7 days: Deploy Chrome version 149.0.7827.53 or later organization-wide. Within 30 days: Verify 100% remediation, document any non-compliant systems, and obtain risk acceptance from management for exceptions.

Google Chrome CVE-2026-11282

Q: Which versions of Google Chrome are affected by CVE-2026-11282?

Google Chrome on Linux prior to version 149.0.7827.53 contains a sandbox escape vulnerability (CVSS 9.6) allowing unauthenticated remote attackers to execute arbitrary code through a crafted webpage.. A patch is available.

EUVD-2026-34743 CRITICAL

Protection Mechanism Failure (CWE-693)

2026-06-05 chrome-cve-admin@google.com

GHSA-gmvx-mxmx-j4x2

Information Disclosure Google

Critical

Disputed · 9.6 Vendor: google

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Lure user to malicious site
Delivery

Deliver crafted HTML page
Exploit

Execute code in renderer sandbox
Execution

Trigger insufficient sandbox policy check
Persist

Escape renderer sandbox boundary
Impact

Access host resources outside sandbox

Vulnerability Assessment

Weakness	CWE CWE-693 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V15 - Secure Coding and Architecture Protection mechanism completeness
Exploitation Conditions	Exploitation requires the victim to be running Google Chrome on Linux at a version below 149.0.7827.53 and to visit an attacker-controlled or compromised web page containing crafted HTML (UI:R in the CVSS vector). No authentication is required on the attacker side (PR:N). The vulnerability is specific to the Linux sandbox implementation - Windows, macOS, Android, and ChromeOS builds are not listed as affected. The description's hedged language ('potentially perform a sandbox escape') and Chromium's Low severity rating imply the primitive may not be standalone-exploitable and would typically need to be chained with a separate renderer-side bug to reach meaningful impact.
Impact	Signals here conflict and require careful interpretation. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H produces a 9.6 score driven primarily by scope change (sandbox escape crosses a trust boundary), but the user-interaction requirement (UI:R) means a victim must visit a malicious page. Chromium's own security severity is rated Low, EPSS sits at 0.03% (11th percentile), and the bug is not on the CISA KEV list - strongly suggesting this is not a priority-zero issue in practice. The description hedges with 'potentially perform a sandbox escape,' implying the issue may not produce a reliable end-to-end escape on its own, which is consistent with Chromium's Low rating. Defenders should treat this as a routine browser patch rather than an emergency, while still prioritizing it on Linux fleets because sandbox-escape primitives are commonly chained with renderer RCE bugs.
Exploit ScenarioDerived	An attacker hosts or compromises a website serving a crafted HTML page; a Linux Chrome user visiting the page triggers the policy-enforcement weakness in the sandbox, potentially allowing renderer-context code to access resources outside the sandbox boundary. Realistically this primitive would be chained with a separate renderer code-execution bug to achieve full code execution on the host, which is the standard browser-exploit pattern. No public exploit identified at time of analysis.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 05, 2026

Sandbox escape in Google Chrome on Linux prior to version 149.0.7827.53 allows remote attackers to potentially break out of the renderer sandbox via a crafted HTML page when a user visits an attacker-controlled site. The flaw stems from insufficient policy enforcement in the Linux sandbox implementation and carries a high CVSS of 9.6 due to scope change, though Chromium itself rates the security severity as Low. No public exploit identified at time of analysis, and EPSS is very low at 0.03%.

RemediationAI

Upgrade Google Chrome on Linux to version 149.0.7827.53 or later, which is the vendor-released patch identified in the Chrome Releases stable-channel update at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. In managed environments, push the update via your endpoint management tooling and verify rollout by inspecting chrome://version on Linux clients. If patching is delayed, compensating controls include restricting browsing to trusted sites via enterprise policy (URLBlocklist/URLAllowlist), enabling Site Isolation (already on by default but verify chrome://flags#enable-site-per-process), and disabling renderer features unnecessary for the workload - recognizing that none of these defeat a successful sandbox escape and the only durable mitigation is the patch. Removing user-namespace support at the kernel level would break Chromium's sandbox entirely and is not recommended.

Affected VersionsENISA

Chrome 149.0.7827.53 <149.0.7827.53

Affected Packages

euvd chrome fix: 149.0.7827.53

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Google Chrome employs a multi-process architecture in which untrusted web content is rendered inside a sandboxed process that, on Linux, relies on seccomp-bpf filters, user namespaces, and Chromium's setuid/namespace sandbox helpers to restrict syscalls and kernel attack surface. CWE-693 (Protection Mechanism Failure) indicates the sandbox's policy layer did not adequately enforce a restriction, allowing renderer-side code to reach resources or capabilities outside the sandbox boundary. The CPE/affected-version data narrows the issue specifically to Linux builds of Chrome prior to 149.0.7827.53, implying a platform-specific gap in policy enforcement rather than a cross-platform Chromium core bug.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Low–Critical)

Vendor (google) PRIMARY 9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE CRITICAL

Red Hat 0.0 LOW

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Jun 05, 2026 - 20:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 05, 2026 - 00:17 nvd

CRITICAL 9.6

DescriptionCVE.org

Insufficient policy enforcement in Sandbox in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

Executive ViewAI

Why It Matters

Google Chrome on Linux prior to version 149.0.7827.53 contains a sandbox escape vulnerability (CVSS 9.6) allowing unauthenticated remote attackers to execute arbitrary code through a crafted webpage. While no public exploit has been identified and exploitation probability is negligible (EPSS 0.03%), this vulnerability directly undermines Chrome's core security architecture and requires immediate patching across all Linux endpoints.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.0%

Top 89% exploitable

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment MSRC Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +48

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.