What is the CVSS score of CVE-2026-11652?

CVE-2026-11652 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11652?

Google Chrome versions prior to 149.0.7827.103 contain a sandbox escape vulnerability (CVSS 8.3) that enables attackers with access to an already-compromised renderer process to break out and gain…. A patch is available.

How to fix or mitigate CVE-2026-11652?

Within 24 hours: Deploy Google Chrome 149.0.7827.103 or later across all endpoints using your patch management system. Within 7 days: Verify deployment completion and review security logs for renderer process anomalies or exploitation indicators. Within 30 days: Conduct a browser security audit focusing on extension controls, renderer isolation, and content isolation policies.

Google Chrome CVE-2026-11652

EUVD-2026-35252 HIGH

Use After Free (CWE-416)

2026-06-09 chrome-cve-admin@google.com

GHSA-mwhv-qc2j-6v6w

Denial Of Service Use After Free Memory Corruption Google

8.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 02:46 vuln.today

CVSS changed

Jun 09, 2026 - 02:22 NVD

8.3 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in Extensions in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 149.0.7827.103 enables a remote attacker who has already compromised the renderer process to break out of the browser sandbox through a use-after-free flaw in the Extensions component, triggered via a crafted HTML page. Google rates the underlying Chromium severity as High and a vendor patch is available, though no public exploit has been identified at time of analysis and the issue is not listed in CISA KEV. The vulnerability is meaningful as the second stage in a multi-bug renderer-to-system exploit chain rather than as a single-shot drive-by.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's Extensions subsystem, which manages the lifecycle of extension objects, events, and IPC bindings between the renderer and the privileged browser process. Use-after-free conditions arise when an object is freed but a dangling pointer is later dereferenced, allowing an attacker to control reused memory and ultimately hijack control flow or corrupt sensitive state. Because Extensions code straddles the renderer/browser-process boundary, a UAF here can be leveraged to influence the higher-privileged browser process and escape Chrome's sandbox, which is exactly the impact described. Affected builds are all Chrome desktop versions earlier than 149.0.7827.103 across the platforms covered by the Stable channel update.

RemediationAI

Vendor-released patch: Chrome 149.0.7827.103 - upgrade all desktop Chrome installations to this version or later via the Stable channel update described at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html and confirm the relaunch has taken effect, since Chrome only completes the update after the browser is restarted. Enterprises managing Chrome via policy should push the update through their EMM/MDM or Chrome Browser Cloud Management and audit the installed version across the fleet. If patching cannot be completed immediately, compensating controls include disabling all non-essential extensions via ExtensionInstallBlocklist policy (trade-off: breaks legitimate extension-dependent workflows) and enforcing Site Isolation plus strict download/JS controls on untrusted origins to make renderer compromise - the required first stage - harder to achieve; these do not eliminate the bug but raise the cost of chaining it. Track downstream Chromium-based browser vendors for their corresponding releases before considering the environment fully remediated.