What is the CVSS score of CVE-2026-11634?

CVE-2026-11634 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11634?

A critical sandbox escape vulnerability in Google Chrome on Windows (CVE-2026-11634) allows attackers to break out of the browser security boundary and execute system-level code when users visit a…. A patch is available.

How to fix or mitigate CVE-2026-11634?

Within 24 hours: Issue security alert to all users, assess Chrome deployment scope across Windows systems, and prepare patch distribution plan for Google Chrome 149.0.7827.103. Within 7 days: Deploy Chrome 149.0.7827.103 to all Windows systems, prioritizing high-risk departments and business-critical endpoints. Within 30 days: Achieve 100% patch compliance verification, enable automatic Chrome updates organization-wide, and conduct threat hunting for any exploitation indicators.

Google Chrome CVE-2026-11634

EUVD-2026-35234 CRITICAL

Use After Free (CWE-416)

2026-06-09 chrome-cve-admin@google.com

GHSA-2h37-qq8x-j923

Google Memory Corruption Use After Free Microsoft Denial Of Service

9.6

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 02:54 vuln.today

CVSS changed

Jun 09, 2026 - 02:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

CRITICAL 9.6

DescriptionCVE.org

Use after free in Gamepad in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

Articles & Coverage 1

News Critical Sandbox Escape via UAF in Google Chrome on Windows - CVE-2026-11634 Jun 09, 2026

AnalysisAI

Sandbox escape in Google Chrome on Windows prior to 149.0.7827.103 allows remote attackers to exploit a use-after-free flaw in the Gamepad component via a crafted HTML page, requiring only that a victim visit a malicious site. Chromium rates this Critical severity and the CVSS score of 9.6 reflects scope change (sandbox escape) with high impact across confidentiality, integrity, and availability. No public exploit identified at time of analysis, but the bug class and Critical Chromium rating make it a high-priority browser patch.

Technical ContextAI

The vulnerability resides in Chrome's Gamepad API implementation, which exposes USB/Bluetooth HID gamepad devices to web pages via the navigator.getGamepads() interface in the renderer process. CWE-416 (Use After Free) indicates that memory referenced by a pointer in the Gamepad subsystem is freed but later reused, typically due to lifecycle mismanagement of device or event objects across the IPC boundary between the renderer sandbox and the browser process. Because the Gamepad service runs with higher privileges than the sandboxed renderer, a UAF triggered through the Gamepad IPC surface is a well-known vector for escaping the Chromium sandbox on Windows, where the renderer is normally confined by job objects and integrity levels.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.103 for Windows - update immediately via the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html and force a relaunch so the new binary loads (Chrome does not apply the fix until the browser is restarted). Enterprise administrators should push the update via Chrome Browser Cloud Management, Google Update policies, or their endpoint management tooling, and verify version on endpoints. As a temporary compensating control before patching, administrators can disable the Gamepad API on managed fleets by blocking access to chrome://gamepad and using site/permission policies, or deploy enhanced site isolation and strict third-party site restrictions; the trade-off is that browser-based games and WebXR/HID-dependent apps will stop working. Users of Chromium-based browsers (Edge, Brave, Opera, Vivaldi) should update as soon as those vendors ship the merged fix.