What is the CVSS score of CVE-2026-11660?

CVE-2026-11660 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11660?

Google Chrome versions prior to 149.0.7827.103 contain a privilege-escalation vulnerability (CVSS 8.3) that could enable attackers to achieve full system access if they successfully compromise the…. A patch is available.

How to fix or mitigate CVE-2026-11660?

Within 24 hours: Inventory Chrome versions deployed across your organization and assess the scope of exposure. Within 7 days: Deploy Chrome 149.0.7827.103 or later to all managed endpoints using your standard patch management process. Within 30 days: Validate patch compliance through endpoint scanning and confirm zero instances of vulnerable Chrome versions remain in your environment.

Google Chrome CVE-2026-11660

EUVD-2026-35260 HIGH

Improper Input Validation (CWE-20)

2026-06-09 chrome-cve-admin@google.com

GHSA-cqm4-2v9f-324r

Information Disclosure Google

8.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 11:26 vuln.today

CVSS changed

Jun 09, 2026 - 11:22 NVD

8.3 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 8.3

DescriptionCVE.org

Insufficient validation of untrusted input in New Tab Page in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome prior to 149.0.7827.103 allows a remote attacker who has already compromised the renderer process to break out of the Chromium sandbox via a crafted HTML page served through the New Tab Page. Google rates the underlying Chromium severity as High and a fix is shipped in the stable channel, but no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

The flaw lives in Chrome's New Tab Page (NTP), a privileged surface that renders chrome:// content and brokers interactions between the renderer and higher-privilege browser process. CWE-20 (Improper Input Validation) indicates that data flowing from an untrusted renderer into NTP handling code is not sufficiently sanitized, enabling logic in a more privileged context to be coerced into actions on the attacker's behalf. Because the NTP sits across the renderer/browser trust boundary, abusing it bridges the per-site renderer sandbox into the broader browser process - the canonical pattern for Chromium sandbox escapes chained from a prior renderer RCE.

RemediationAI

Vendor-released patch: Chrome 149.0.7827.103 - upgrade all Chrome desktop installations to 149.0.7827.103 or later via the stable channel update described at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html, and force-restart browsers so the new binary actually loads. For managed fleets, push the update through Chrome Browser Cloud Management or your endpoint management tool and verify the version via chrome://settings/help. Track and apply the corresponding security update for any embedded Chromium (Edge, Brave, Opera, Electron apps) once each vendor rebases. As an interim compensating control before patching, restrict access to attacker-controlled web content (enterprise URL allow-lists or browsing through an isolation/RBI gateway) and disable or restrict NTP customizations and third-party NTP extensions via the NewTabPageLocation and ExtensionInstallBlocklist enterprise policies - note the trade-off that URL allow-listing breaks general browsing and isolation gateways add latency and break some web apps.