What is the CVSS score of CVE-2026-11301?

CVE-2026-11301 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11301?

Google Chrome's LiveCaption feature contains a memory vulnerability (CVSS 8.8) enabling attackers to extract sensitive data from browser memory through malicious network traffic.. A patch is available.

How to fix or mitigate CVE-2026-11301?

24 hours: Alert IT and security teams to CVE-2026-11301; assess Chrome deployment scope and identify systems with LiveCaption enabled. 7 days: Deploy Chrome 149.0.7827.53 or later via patch management channels, prioritizing identified LiveCaption users. 30 days: Verify patch adoption across at least 95% of Chrome instances.

Google Chrome CVE-2026-11301

EUVD-2026-34762 HIGH

Out-of-bounds Read (CWE-125)

2026-06-05 chrome-cve-admin@google.com

GHSA-5x33-56vh-29gj

Buffer Overflow Information Disclosure Google

High

Disputed · 8.8 Vendor: google

Severity by source

Sources disagree (Low–High)

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

7.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 16:27 vuln.today

CVSS changed

Jun 05, 2026 - 16:22 NVD

8.8 (HIGH)

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 05, 2026 - 00:17 nvd

HIGH 8.8

DescriptionCVE.org

Inappropriate implementation in LiveCaption in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform out of bounds memory access via malicious network traffic. (Chromium security severity: Low)

AnalysisAI

Out-of-bounds memory access in Google Chrome's LiveCaption component prior to version 149.0.7827.53 allows a remote attacker to read beyond allocated buffers by delivering crafted network traffic to a user with the feature in use. EPSS is very low (0.03%, 11th percentile) and there is no public exploit identified at time of analysis, though Google's Chromium tracker rated severity Low while NVD's CVSS scored it 8.8 High - a notable disparity worth weighing when prioritizing.

Technical ContextAI

LiveCaption is Chrome's on-device accessibility feature that transcribes audio from media and call streams in the browser, processing network-delivered audio/media payloads through a parser pipeline. CWE-125 (Out-of-bounds Read) indicates the implementation reads memory outside the bounds of an allocated buffer, typically due to missing length validation on attacker-controlled fields in the media stream. The affected component sits inside the renderer/media stack of Chromium, so exploitation is constrained by Chrome's sandbox unless chained with a sandbox escape.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - update Chrome via the built-in updater or by restarting the browser, per the Stable Channel announcement at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Enterprise fleets should push the 149.0.7827.53 build through their managed update channel and verify rollout with chrome://version. As a temporary compensating control while patching, administrators can disable LiveCaption via the LiveCaptionEnabled enterprise policy (set to false) to remove the affected code path; the trade-off is loss of in-browser captioning for users who rely on it for accessibility. Chromium-derivative browsers (Edge, Brave, Opera, Vivaldi) should be updated once their corresponding rebased builds ship.