What is the CVSS score of CVE-2026-11654?

CVE-2026-11654 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11654?

Google Chrome for Mac versions prior to 149.0.7827.103 contains a critical sandbox escape vulnerability (CVE-2026-11654, CVSS 9.6) in the CameraCapture component that could allow attackers to execute…. A patch is available.

How to fix or mitigate CVE-2026-11654?

Within 24 hours: Identify all Mac users running Chrome versions prior to 149.0.7827.103 and send urgent patch notification. Within 7 days: Deploy Chrome 149.0.7827.103 or later via MDM across all Mac systems and update deployment policies to enforce this minimum version. Within 30 days: Verify patch compliance across all Mac endpoints and document remediation of any exceptions.

Google Chrome CVE-2026-11654

EUVD-2026-35254 CRITICAL

Use After Free (CWE-416)

2026-06-09 chrome-cve-admin@google.com

GHSA-56wm-h6f8-c34v

Denial Of Service Use After Free Memory Corruption Google

9.6

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 11:25 vuln.today

CVSS changed

Jun 09, 2026 - 11:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

CRITICAL 9.6

DescriptionCVE.org

Use after free in CameraCapture in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome for Mac (versions prior to 149.0.7827.103) stems from a use-after-free condition in the CameraCapture component, enabling a remote attacker to break out of the renderer sandbox via a crafted HTML page. With a CVSS of 9.6 (scope-changed, high impact across CIA) and an upstream fix released by Google, the bug carries high severity but requires user interaction to load the malicious page; no public exploit identified at time of analysis.

Technical ContextAI

The flaw resides in CameraCapture, the Chromium subsystem responsible for handling camera input via getUserMedia / WebRTC media stream APIs on macOS. CWE-416 (Use After Free) indicates that an object backing a camera capture session is freed while another code path still holds a dangling reference, allowing the attacker to coerce reuse of that memory and corrupt control data. Because the bug lives in code that bridges renderer requests to platform media APIs, successful exploitation pivots from the sandboxed renderer into more privileged browser/process context - consistent with the scope change (S:C) in the CVSS vector and Google's classification as a sandbox escape.

RemediationAI

Primary fix: upgrade Google Chrome on macOS to 149.0.7827.103 or later (vendor-released patch confirmed by Google via the Chrome Releases Stable Channel post at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html); on managed fleets, force-restart Chrome so the staged update actually loads. If patching is briefly delayed, compensating controls include blocking camera access in Chrome via enterprise policy (VideoCaptureAllowed=false or DefaultMediaStreamSetting=2), which neutralizes the vulnerable CameraCapture code path at the cost of breaking legitimate WebRTC/video-conferencing use cases, and steering users to a non-Chromium browser on macOS for untrusted browsing until rollout completes. Generic web-filtering of unknown sites reduces exposure but does not address the underlying use-after-free. Chromium-derived browsers (Edge, Brave, Opera, Vivaldi) should be checked against their own vendor advisories, as they typically inherit this fix on a short delay.