What is the CVSS score of CVE-2026-11655?

CVE-2026-11655 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11655?

Google Chrome on macOS versions below 149.0.7827.103 contain a sandbox escape vulnerability that allows attackers who have compromised the browser's renderer process to execute arbitrary code with…. A patch is available.

How to fix or mitigate CVE-2026-11655?

Within 24 hours: Inventory all macOS devices with Google Chrome installed and identify those below version 149.0.7827.103. Within 7 days: Deploy Chrome version 149.0.7827.103 or later to all affected macOS systems via your device management platform or auto-update enforcement. Within 30 days: Confirm patch deployment to 100% of affected endpoints and review browser security logs for exploitation attempts.

Google Chrome CVE-2026-11655

EUVD-2026-35255 HIGH

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-06-09 chrome-cve-admin@google.com

GHSA-74g6-5mjw-f8x6

Google Buffer Overflow

8.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 11:25 vuln.today

CVSS changed

Jun 09, 2026 - 11:22 NVD

8.3 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 8.3

DescriptionCVE.org

Integer overflow in Media in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on macOS prior to version 149.0.7827.103 enables a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page that triggers an integer overflow in the Media component. Google rates the Chromium severity as High, and no public exploit has been identified at time of analysis. Because exploitation requires chaining with a separate renderer compromise plus user interaction (visiting a malicious page), the attack complexity is High despite the network attack vector.

Technical ContextAI

The flaw resides in Chrome's Media subsystem, which handles audio/video decoding and playback pipelines that operate across the renderer/browser process boundary. CWE-472 (External Control of Assumed-Immutable Web Parameter) combined with the 'integer overflow' wording in the description and the 'Buffer Overflow' tag indicates that a size or offset value crossing the IPC boundary from the renderer is not properly validated by a more-privileged process, allowing arithmetic wraparound that leads to out-of-bounds memory access or undersized allocations. Because Media code runs partly in the GPU/browser process on macOS, a wraparound there lets a malicious renderer corrupt memory outside its sandbox. The Scope:Changed CVSS attribute reflects exactly this cross-boundary escape from the sandboxed renderer into a more privileged Chrome process.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.103 for macOS - upgrade Chrome Stable on all Mac endpoints to 149.0.7827.103 or later via the Chrome Releases stable-channel update (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html), and force-restart the browser so the new binary is actually loaded (a common gap, since Chrome auto-downloads but does not auto-relaunch). For Chromium-derived browsers on macOS (Edge, Brave, Opera, Vivaldi), apply the corresponding downstream release that incorporates the Chromium fix. As a temporary compensating control where immediate patching is not possible, deploy MDM policy to disable media autoplay and consider blocking untrusted sites via SafeBrowsing/enterprise URL filtering to reduce drive-by exposure; note that fully disabling Chrome's media stack is not practical, and these controls only reduce - not eliminate - the chance of reaching the vulnerable code path.