What is the CVSS score of CVE-2026-11665?

CVE-2026-11665 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-11665?

Yes, a patch is available for CVE-2026-11665. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11665

EUVD-2026-35265 MEDIUM

Out-of-bounds Read (CWE-125)

2026-06-09 chrome-cve-admin@google.com

GHSA-5mhg-rh4j-h587

Information Disclosure Google Microsoft Buffer Overflow

Medium

Disputed · 4.3 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

SUSE

CRITICAL

qualitative

Red Hat

6.5 HIGH

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 03:00 vuln.today

CVSS changed

Jun 09, 2026 - 02:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

MEDIUM 4.3

DescriptionCVE.org

Out of bounds read in Dawn in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Out-of-bounds read in Dawn, Chrome's WebGPU graphics API layer, on Windows enables unauthenticated remote attackers to leak cross-origin data by serving a crafted HTML page. Affected versions of Google Chrome on Windows are all releases prior to 149.0.7827.103. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) confirms this is a network-exploitable, low-complexity information disclosure with no authentication requirement - limited only by the need for a user to visit the attacker-controlled page. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Dawn is Google's open-source, cross-platform graphics API abstraction layer used in Chromium to implement the WebGPU standard. CWE-125 (Out-of-bounds Read) describes the root cause: the Dawn component reads beyond the boundary of an allocated memory buffer. In a browser renderer context, this class of flaw can expose memory contents belonging to a different security origin - violating the Same-Origin Policy - because renderer memory may contain data from multiple loaded resources. The vulnerability is scoped to Chrome on Windows specifically (per the NVD description), suggesting the OOB condition may be triggered by platform-specific graphics driver interactions or memory layout differences. The CVSS Scope:Unchanged (S:U) rating indicates the impact is confined to the renderer process itself rather than escaping to the OS or other processes.

RemediationAI

The primary fix is to update Google Chrome to version 149.0.7827.103 or later on Windows - this is a vendor-released patch confirmed by the Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html. Chrome's auto-update mechanism should handle delivery for most managed and consumer deployments; administrators should verify fleet compliance via endpoint management tooling. As a compensating control pending patch deployment, organizations can restrict access to untrusted external web content via proxy policy or browser isolation solutions, though this carries operational trade-offs for general browsing workflows. Disabling or restricting WebGPU via Chrome enterprise policy (WebGpuEnabled) would also reduce Dawn attack surface, but will break sites relying on WebGPU and should be tested before broad deployment.