What is the CVSS score of CVE-2026-11640?

CVE-2026-11640 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-11640?

Google Chrome versions before 149.0.7827.103 contain a sandbox escape vulnerability that could allow an attacker with an already-compromised browser renderer process to execute code outside the…. A patch is available.

How to fix or mitigate CVE-2026-11640?

24 hours: Identify all systems running Chrome versions prior to 149.0.7827.103 using endpoint management or vulnerability scanning tools. 7 days: Deploy Chrome 149.0.7827.103 or later organization-wide via patch management systems and enforce automatic updates if not already enabled. 30 days: Verify patch deployment completion and confirm zero systems remain on vulnerable versions through compliance scanning.

Google Chrome CVE-2026-11640

EUVD-2026-35240 HIGH

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-06-09 chrome-cve-admin@google.com

GHSA-p626-pw8w-29p4

Google Buffer Overflow

8.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 14:23 vuln.today

CVSS changed

Jun 09, 2026 - 14:22 NVD

8.3 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 8.3

DescriptionCVE.org

Integer overflow in libyuv in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 149.0.7827.103 enables a remote attacker who has already compromised the renderer process to break out of the browser sandbox via an integer overflow in the libyuv image conversion library. Exploitation requires user interaction with a crafted HTML page and a chained renderer compromise, but Google rated the underlying issue Critical because a successful chain yields code execution outside Chrome's sandbox. There is no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.03%.

Technical ContextAI

libyuv is an open-source YUV scaling and conversion library used by Chrome (and many media pipelines) to handle image and video color-space transforms; it is invoked from the renderer when decoding or transforming visual content. The flaw is classified as CWE-472 (External Control of Assumed-Immutable Web Parameter) but the description and Google's 'Buffer Overflow' tagging point to an integer overflow in libyuv's size or stride calculations that, when crafted inputs are supplied, leads to an undersized allocation and subsequent out-of-bounds write. Because libyuv code paths are reachable from the renderer process, an attacker who already controls the renderer (typically via a prior renderer RCE) can drive the overflow into adjacent process memory or shared buffers used during cross-process media handling, providing a route to escape Chrome's site-isolation sandbox.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.103 - update Chrome to 149.0.7827.103 or later via the stable channel and restart the browser to apply, as described at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html (tracking issue https://issues.chromium.org/issues/517339758). Administrators managing Chromium-derived browsers should monitor their vendor's advisories and roll the corresponding libyuv update once available. As compensating controls until patching, enforce auto-update via enterprise policy (ChromeEnterprise 'RelaunchNotification' / 'RelaunchNotificationPeriod') to shorten the exposure window, and consider tightening site isolation and disabling unnecessary media/codec features in high-risk environments - note that disabling media codecs will break legitimate video and image-heavy sites and is not a substitute for the patch.