What is the CVSS score of CVE-2026-11659?

CVE-2026-11659 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11659?

Google Chrome on Linux contains a critical sandbox escape vulnerability (CVE-2026-11659, CVSS 9.6) enabling remote code execution when users visit malicious web pages, affecting all Linux-based…. A patch is available.

How to fix or mitigate CVE-2026-11659?

24 hours: Notify stakeholders and begin testing Google Chrome 149.0.7827.103 on representative Linux systems. 7 days: Initiate enterprise-wide deployment of Chrome 149.0.7827.103 to all Linux systems with Chrome installed. 30 days: Verify 95%+ deployment coverage and document remediation completion.

Google Chrome CVE-2026-11659

EUVD-2026-35259 CRITICAL

Improper Input Validation (CWE-20)

2026-06-09 chrome-cve-admin@google.com

GHSA-m2rp-hqmh-cm5f

Google Buffer Overflow

9.6

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 11:26 vuln.today

CVSS changed

Jun 09, 2026 - 11:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

CRITICAL 9.6

DescriptionCVE.org

Integer overflow in UI in Google Chrome on Linux prior to 149.0.7827.103 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on Linux prior to 149.0.7827.103 can be triggered by an integer overflow in the browser's UI component when a victim visits a crafted HTML page. Rated CVSS 9.6 with scope change, this issue allows a remote attacker to break out of the Chrome renderer sandbox after one click or navigation, though no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Technical ContextAI

The flaw resides in Chrome's UI subsystem on Linux builds and is classified under CWE-20 (Improper Input Validation), manifesting as an integer overflow - confirmed by the vendor-supplied 'Buffer Overflow' tag - where untrusted size or offset values are not adequately bounds-checked before being used in memory arithmetic. Because the bug lives in a privileged browser-side component (not just the sandboxed renderer), corrupting it produces a sandbox escape: code that should be confined by Chrome's Linux seccomp-bpf / namespace sandbox can reach into the higher-privilege browser process context. The affected technology is the Chromium-based Chrome stable channel for Linux desktop, tracked internally at issues.chromium.org/issues/513702971.

RemediationAI

Upgrade to Google Chrome 149.0.7827.103 or later on Linux as the primary fix, per the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html; this is a vendor-released patch with an exact fix version. For managed fleets, push the update via your package manager (apt/yum/snap) or MDM channel and verify by checking chrome://settings/help on representative hosts. If immediate patching is blocked, restrict Chrome usage to trusted sites via enterprise policy URLBlocklist/URLAllowlist, disable JavaScript on untrusted origins (which substantially degrades usability but blunts the HTML-delivery vector), and consider routing browsing through a remote browser isolation tier until the update lands - note these compensating controls only reduce delivery surface and do not fix the underlying overflow. Track downstream Chromium-based browsers separately and apply their respun builds as they become available.