What is the CVSS score of CVE-2026-11642?

CVE-2026-11642 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11642?

Google Chrome versions prior to 149.0.7827.103 contain a sandbox escape vulnerability that enables attackers to achieve full browser compromise if they have already compromised the renderer process…. A patch is available.

How to fix or mitigate CVE-2026-11642?

Within 24 hours: Alert IT and end users that Chrome 149.0.7827.103 or later is required. Within 7 days: Deploy Chrome 149.0.7827.103 or later to test environments and confirm compatibility with critical applications. Within 30 days: Complete organization-wide deployment of Chrome 149.0.7827.103 or later via auto-update policies or managed deployment; verify compliance through browser telemetry.

Google Chrome CVE-2026-11642

EUVD-2026-35242 HIGH

Use After Free (CWE-416)

2026-06-09 chrome-cve-admin@google.com

GHSA-9mmw-r35m-g52r

Denial Of Service Use After Free Memory Corruption Google

8.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 02:51 vuln.today

CVSS changed

Jun 09, 2026 - 02:22 NVD

8.3 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in Web Apps in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 149.0.7827.103 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page exploiting a use-after-free in Web Apps. Chromium rates the severity as Critical, and a vendor patch is available, though no public exploit has been identified at time of analysis. This is a second-stage vulnerability typically chained with a renderer RCE to achieve full browser compromise.

Technical ContextAI

The flaw resides in Chrome's Web Apps component (the subsystem responsible for installable Progressive Web Apps and related window/manifest handling) and is classified as CWE-416 (Use After Free), a memory-corruption class where freed heap memory is referenced again, allowing an attacker to control the contents at that address and hijack control flow or type confusion. Because the bug lives on the privileged (browser-process) side of the IPC boundary, it is reachable from a compromised renderer and can be used to defeat Chrome's site-isolation/sandbox model. The affected component runs in the broker process, which is precisely why exploitation grants the attacker the host privileges of the browser process rather than just renderer privileges.

RemediationAI

Vendor-released patch: update Google Chrome to 149.0.7827.103 or later via the stable channel auto-update mechanism (chrome://settings/help to force a check and relaunch). Enterprise admins managing Chrome via group policy or MDM should push the new build and verify deployment across the fleet, and downstream Chromium-based browsers should be updated as soon as their vendors ship a rebased build. If patching must be delayed, compensating controls include restricting users to enterprise-approved sites via URL allowlists, disabling installable Web Apps through the WebAppInstallForceList/DefaultWebAppInstallForceList policies (side effect: breaks legitimate PWA workflows), and enforcing site isolation plus strict third-party cookie blocking to reduce the attack surface for the prerequisite renderer compromise. Refer to the advisory at chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html.