What is the CVSS score of CVE-2026-11647?

CVE-2026-11647 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11647?

Chrome on Android versions before 149.0.7827.103 contain a high-severity sandbox escape vulnerability (CVE-2026-11647, CVSS 8.3) that could enable attackers to gain system-level control of affected…. A patch is available.

How to fix or mitigate CVE-2026-11647?

Within 24 hours: Audit managed and BYOD Android devices to identify Chrome versions prior to 149.0.7827.103. Within 7 days: Deploy Chrome 149.0.7827.103 or later through MDM solutions and user update policies. Within 30 days: Verify 100% of Android Chrome installations meet the minimum patched version requirement.

Google Chrome CVE-2026-11647

EUVD-2026-35247 HIGH

Use After Free (CWE-416)

2026-06-09 chrome-cve-admin@google.com

GHSA-jrj3-rghx-689r

Denial Of Service Use After Free Memory Corruption Google

8.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 02:48 vuln.today

CVSS changed

Jun 09, 2026 - 02:22 NVD

8.3 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in Printing in Google Chrome on Android prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on Android prior to 149.0.7827.103 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page exploiting a use-after-free in the Printing component. Google rates this High severity, and a vendor patch is available, but no public exploit identified at time of analysis and the vulnerability requires chaining with a separate renderer compromise plus user interaction with a print flow.

Technical ContextAI

The flaw is a CWE-416 Use-After-Free in Chromium's Printing subsystem, which handles print preview and document rendering pipelines between the renderer and privileged browser process on Android. Use-after-free conditions arise when an object is freed but a dangling pointer is later dereferenced, allowing an attacker who controls heap layout to reclaim the freed slot with attacker-chosen data and corrupt control flow. Because Printing IPC crosses the renderer/browser trust boundary, memory corruption here can be leveraged to execute code in the higher-privileged browser process, escaping Chrome's site-isolation sandbox on Android (Chromium-based on Blink/V8, CPE applies to chrome:chrome on android prior to 149.0.7827.103).

RemediationAI

Vendor-released patch: update Google Chrome for Android to 149.0.7827.103 or later via the Google Play Store, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html and the upstream Chromium issue at https://issues.chromium.org/issues/502156940. For managed Android fleets, push the updated Chrome APK through MDM/EMM and verify the installed version on enrolled devices. As a compensating control until devices are updated, disable or restrict use of the in-browser Print function on Android (this prevents users from invoking the vulnerable code path but breaks legitimate print-to-PDF and physical printing workflows from Chrome), and consider restricting browsing to trusted sites since exploitation requires a malicious HTML page; for Chromium-derived browsers, confirm the downstream build has rebased onto the fixed milestone before treating them as remediated.