What is the CVSS score of CVE-2026-11306?

CVE-2026-11306 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11306?

Google Chrome contains a critical remote code execution vulnerability (CVE-2026-11306) in its PDF rendering engine affecting all users with older Chrome versions; attackers could execute arbitrary…. A patch is available.

How to fix or mitigate CVE-2026-11306?

24 hours: Inventory all Chrome deployments; communicate patch urgency to endpoint owners; verify patch deployment infrastructure is operational. 7 days: Deploy Google Chrome 149.0.7827.53 or later to all endpoints using your standard patch management process; prioritize high-risk devices (client-facing, developer machines, security team); enable auto-updates if not already active. 30 days: Verify 95% or greater adoption of patched Chrome version across the organization; audit non-compliant systems and document remediation; assess patch deployment metrics and process effectiveness.

Google Chrome CVE-2026-11306

EUVD-2026-34767 HIGH

Use After Free (CWE-416)

2026-06-05 chrome-cve-admin@google.com

GHSA-h46q-9c5h-x87h

Google Memory Corruption RCE Use After Free Denial Of Service Chrome

High

Disputed · 8.8 NVD

Severity by source

Sources disagree (Low–High)

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 03:15 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 05, 2026 - 00:17 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Low)

AnalysisAI

Remote code execution in Google Chrome versions prior to 149.0.7827.53 stems from a use-after-free flaw in the PDFium component, allowing a remote attacker to execute arbitrary code within the renderer sandbox by serving a crafted PDF file. While exploitation is constrained to the sandbox and requires user interaction (visiting a page or opening a PDF), the CVSS score of 8.8 reflects the high impact on confidentiality, integrity, and availability if combined with a sandbox escape. No public exploit identified at time of analysis, and CISA SSVC indicates exploitation status of 'none'.

Technical ContextAI

PDFium is the open-source PDF rendering engine embedded in Chromium-based browsers (Chrome, Edge, Brave, Opera) to parse and display PDF files inline. The vulnerability is CWE-416 (Use After Free), a memory-safety class where an object is freed but a dangling pointer to it is later dereferenced, enabling attackers to potentially read freed memory, corrupt heap structures, or hijack control flow. PDFium has historically been a frequent source of Chrome browser vulnerabilities due to the complexity of the PDF format and its parsing of untrusted content, and Google's own classification rates this issue as 'Low' severity at the Chromium level - likely because exploitation occurs inside the renderer sandbox rather than escaping it.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 (Stable channel). Update Chrome immediately to 149.0.7827.53 or later via the built-in updater (chrome://settings/help) or by redeploying through enterprise management tooling (Group Policy, MDM, Chrome Browser Cloud Management). Verify Chromium-derived browsers (Edge, Brave, Opera) have integrated the upstream PDFium fix before considering them patched. Compensating controls while patching: disable the built-in PDF viewer via the AlwaysOpenPdfExternally policy so PDFs download rather than render in PDFium (trade-off: degrades user experience and shifts risk to the external PDF handler), or block inline PDF rendering at the web proxy by stripping/quarantining application/pdf content (trade-off: breaks legitimate workflows). Reference: https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html.