What is the CVSS score of CVE-2026-11661?

CVE-2026-11661 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11661?

Google Chrome on Windows contains a sandbox escape vulnerability (CVE-2026-11661, CVSS 8.3) affecting all versions prior to 149.0.7827.103.. A patch is available.

How to fix or mitigate CVE-2026-11661?

Within 24 hours: Inventory Chrome versions across Windows systems using endpoint management and identify users on versions prior to 149.0.7827.103. Within 7 days: Deploy Chrome 149.0.7827.103 or later to all affected Windows endpoints using automated patch management and group policy enforcement. Within 30 days: Verify patching completion and audit endpoint logs for exploitation attempts.

Google Chrome CVE-2026-11661

EUVD-2026-35261 HIGH

Use After Free (CWE-416)

2026-06-09 chrome-cve-admin@google.com

GHSA-mxr8-43v7-9g35

Google Memory Corruption Use After Free Microsoft Denial Of Service

8.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 11:27 vuln.today

CVSS changed

Jun 09, 2026 - 11:22 NVD

8.3 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in Views in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on Windows prior to 149.0.7827.103 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a use-after-free in the Views component, triggered through a crafted HTML page. Google rates this Chromium security severity High and a vendor patch is available; no public exploit identified at time of analysis and the bug is not currently listed in CISA KEV.

Technical ContextAI

The flaw resides in Chromium's Views UI framework, a C++ library used to construct browser windows, dialogs, and other native controls on desktop platforms including Windows. CWE-416 (Use After Free) indicates that an object in the Views subsystem is freed while a dangling pointer to it is still reachable, and subsequent reuse of that memory allows an attacker to coerce control flow or corrupt state. Because Views runs in the privileged browser process rather than the sandboxed renderer, a UAF here is a classic stepping stone from renderer compromise to full sandbox escape, undermining Chrome's site-isolation and process-sandbox security model on Windows.

RemediationAI

Upgrade Google Chrome on Windows to 149.0.7827.103 or later, which is the vendor-released patched version per the Chrome Releases stable channel update at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html; in managed environments confirm that Chrome's auto-update has rolled out and force-update endpoints that are pinned or offline. Users of Chromium-based browsers (Edge, Brave, Opera, Vivaldi) should apply their vendor's corresponding update once it incorporates the upstream fix tracked at https://issues.chromium.org/issues/513748868. No vendor-supplied workaround is documented; as a compensating control until patching completes, restrict browsing to trusted sites via enterprise policy or a web proxy and ensure Windows exploit-mitigation features (CET, ACG, CFG) and Chrome's site-isolation are enabled, accepting that these reduce but do not eliminate sandbox-escape risk and may break legacy intranet apps.