What is the CVSS score of CVE-2026-11638?

CVE-2026-11638 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11638?

Google Chrome versions prior to 149.0.7827.103 contain a critical sandbox escape vulnerability (CVSS 9.6) that allows remote attackers to execute arbitrary code on users' systems through a crafted…. A patch is available.

How to fix or mitigate CVE-2026-11638?

Within 24 hours: Audit Chrome version distribution across all endpoints and identify users on versions prior to 149.0.7827.103. Within 7 days: Deploy Chrome 149.0.7827.103 or later via patch management; block older versions if technically feasible. Within 30 days: Verify 100% deployment completion and confirm no legacy versions remain in use.

Google Chrome CVE-2026-11638

EUVD-2026-35238 CRITICAL

Use After Free (CWE-416)

2026-06-09 chrome-cve-admin@google.com

GHSA-4h64-69gw-4pgg

Denial Of Service Use After Free Memory Corruption Google

9.6

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 02:53 vuln.today

CVSS changed

Jun 09, 2026 - 02:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

CRITICAL 9.6

DescriptionCVE.org

Use after free in Printing in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

Articles & Coverage 1

News Critical Sandbox Escape in Google Chrome prior to 149.0.7827.103 - CVE-2026-11638 Jun 09, 2026

AnalysisAI

Sandbox escape in Google Chrome versions prior to 149.0.7827.103 enables remote attackers to break out of the browser's renderer sandbox via a crafted HTML page that triggers a use-after-free in the Printing component. Chromium rated this issue Critical severity, and the CVSS scope change (S:C) confirms the sandbox boundary is crossed; no public exploit identified at time of analysis, but the attack only requires the victim to load attacker-controlled content.

Technical ContextAI

The flaw resides in Chromium's Printing subsystem, which handles print preview rendering, PDF generation, and the print dialog flow across renderer and browser processes. CWE-416 (Use After Free) indicates that an object is referenced after its memory has been freed, typically producing a dangling pointer that an attacker can groom to control freed memory contents. In Chromium, such Printing-component UAFs have historically been weaponized to corrupt IPC handlers or privileged browser-process objects, which is consistent with the scope-changed (S:C) CVSS vector here that signals impact beyond the originally compromised component - in this case, escape from the renderer sandbox.

RemediationAI

Upgrade Google Chrome to version 149.0.7827.103 or later on all desktop platforms; this is the vendor-released patch referenced in the Stable Channel update at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html, with tracking details at https://issues.chromium.org/issues/517047197. Force-relaunch managed browsers via enterprise policy to ensure the update applies, and verify build numbers post-deployment. As compensating controls until patching completes, administrators can disable the in-browser print preview / printing feature through enterprise policy (PrintingEnabled=false), which removes the vulnerable code path at the cost of breaking legitimate web-initiated printing, and can restrict browsing to trusted sites via SafeSites or URL allowlists to reduce exposure to crafted HTML, accepting the productivity impact of constrained browsing.