What is the CVSS score of CVE-2026-11656?

CVE-2026-11656 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-11656?

Google Chrome contains a sandbox escape vulnerability (CVE-2026-11656, CVSS 8.3) that grants attackers complete control of the browser process if users install a malicious extension.. A patch is available.

How to fix or mitigate CVE-2026-11656?

24 hours: Inventory Chrome deployments and document current version distribution across the enterprise. 7 days: Test Chrome 149.0.7827.103 or later in production environment and begin staged deployment. 30 days: Complete deployment of Chrome 149.0.7827.103 or later to all systems and verify zero instances of vulnerable versions remain.

Google Chrome CVE-2026-11656

EUVD-2026-35256 HIGH

Use After Free (CWE-416)

2026-06-09 chrome-cve-admin@google.com

GHSA-g324-4x5c-75c4

Denial Of Service Use After Free Memory Corruption Google

8.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 02:45 vuln.today

CVSS changed

Jun 09, 2026 - 02:22 NVD

8.3 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in ServiceWorker in Google Chrome prior to 149.0.7827.103 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 149.0.7827.103 stems from a use-after-free condition in the ServiceWorker component, allowing an attacker to break out of Chrome's renderer sandbox through a crafted malicious extension. The flaw is rated Chromium severity High with CVSS 8.3 and no public exploit identified at time of analysis, but the scope-change (S:C) and full CIA impact mean a successful escape grants meaningful control over the host browser process. Exploitation requires the victim to install the attacker's extension, which constrains opportunistic mass exploitation but is realistic against targeted users.

Technical ContextAI

ServiceWorkers are background scripts that run independently of web pages and mediate network requests, push notifications, and offline caching within Chrome's multi-process architecture. CWE-416 (Use After Free) indicates that memory referenced by the ServiceWorker subsystem is freed while a dangling pointer is still reachable, allowing an attacker to reclaim that memory with controlled data and corrupt object state. Because the bug is reachable from extension-supplied code and crosses into the privileged browser process, it produces a scope change (CVSS S:C) - the renderer/extension sandbox boundary is bypassed, giving the attacker the privileges of the broader Chrome process rather than just the sandboxed worker.

RemediationAI

Update Chrome to version 149.0.7827.103 or later on the stable desktop channel - vendor-released patch is available per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html) and the Chromium issue tracker entry at https://issues.chromium.org/issues/513424000. Restart Chrome after the auto-update completes, since the running process keeps the vulnerable binary mapped until relaunch. As a compensating control until patching, restrict extension installation via enterprise policy (ExtensionInstallAllowlist / ExtensionInstallBlocklist or ExtensionInstallForcelist with a curated list), which directly removes the UI:R precondition at the cost of blocking user-driven extension adoption; for Chromium-based browsers, apply the equivalent vendor build that incorporates the upstream fix.