What is the CVSS score of CVE-2026-11295?

CVE-2026-11295 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11295?

Google Chrome's WebView component on Android contains a privilege escalation vulnerability (CVSS 8.8) affecting versions prior to 149.0.7827.53 that could allow attackers to compromise device…. A patch is available.

How to fix or mitigate CVE-2026-11295?

Within 24 hours: Identify Android devices using Chrome and assess current version distribution. Within 7 days: Deploy Chrome version 149.0.7827.53 or later to all affected devices, prioritizing business-critical systems. Within 30 days: Verify 100% patch deployment and configure mobile device management to enforce automatic Chrome updates.

Google Chrome CVE-2026-11295

EUVD-2026-34756 HIGH

Improper Privilege Management (CWE-269)

2026-06-05 chrome-cve-admin@google.com

GHSA-v5mq-v754-jjc6

Google Privilege Escalation Chrome

High

Disputed · 8.8 NVD

Severity by source

Sources disagree (Low–High)

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

6.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 20:28 vuln.today

CVSS changed

Jun 05, 2026 - 20:22 NVD

8.8 (HIGH)

CVE Published

Jun 05, 2026 - 00:17 nvd

HIGH 8.8

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Privilege escalation in Google Chrome's WebView component on Android prior to version 149.0.7827.53 allows a remote attacker to elevate privileges by serving a crafted HTML page to a victim. The flaw requires user interaction (visiting or rendering the malicious page) and carries a CVSS 8.8 due to the high confidentiality, integrity, and availability impact across the browser sandbox. No public exploit identified at time of analysis, and EPSS is very low at 0.04%, but Google has shipped a fix.

Technical ContextAI

WebView is the Android system component (built on Chromium) that lets native applications embed web content and is used by countless third-party Android apps in addition to Chrome itself. The root cause is classified as CWE-269 (Improper Privilege Management), meaning the WebView implementation fails to correctly enforce the privilege boundary between web-origin content and the hosting application or browser process. Because WebView is shared across many Android apps via the Android System WebView package, a defect here has a broad blast radius beyond Chrome's own UI, affecting any app that renders untrusted web content through the platform WebView.

RemediationAI

Vendor-released patch: Google Chrome for Android 149.0.7827.53 or later - update via Google Play or the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. On Android, also ensure the Android System WebView package is updated through the Play Store so embedded WebViews in third-party apps inherit the fix; this is independent of updating the Chrome browser binary. If updates are temporarily blocked by MDM or device policy, restrict users from browsing untrusted sites in Chrome on Android and consider blocking known attacker-controlled domains at the network layer; note this only mitigates the browser path and not WebViews embedded in other installed apps, so it is partial coverage. Additional cross-reference: https://nvd.nist.gov/vuln/detail/CVE-2026-11295.