What is the CVSS score of CVE-2026-11667?

CVE-2026-11667 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11667?

A high-severity vulnerability in Google Chrome (CVE-2026-11667) could allow attackers who have already compromised the GPU process to break out of the sandbox and corrupt system memory through…. A patch is available.

How to fix or mitigate CVE-2026-11667?

Within 24 hours: Identify Chrome deployment scope across the organization and enable automatic updates if not already active. Within 7 days: Deploy Chrome 149.0.7827.103 or later to all endpoints through enterprise deployment mechanisms or auto-update enforcement. Within 30 days: Verify patch deployment completion via asset inventory systems, review GPU process logs for exploitation indicators prior to patching, and document remediation completion for compliance records.

Google Chrome CVE-2026-11667

EUVD-2026-35267 HIGH

Out-of-bounds Read (CWE-125)

2026-06-09 chrome-cve-admin@google.com

GHSA-wx6h-3mh7-h885

Information Disclosure Google Buffer Overflow

7.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

8.3 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 11:28 vuln.today

CVSS changed

Jun 09, 2026 - 11:22 NVD

7.5 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 7.5

DescriptionCVE.org

Out of bounds read in WebRTC in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the GPU process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Out-of-bounds read in the WebRTC component of Google Chrome before 149.0.7827.103 enables a remote attacker who has already compromised the GPU process to escalate into heap corruption via a crafted HTML page. Google rates this High severity and a vendor patch is available; no public exploit identified at time of analysis. The flaw is a chained-exploitation primitive rather than a standalone RCE, requiring a prior sandbox-adjacent foothold plus user interaction.

Technical ContextAI

WebRTC is the real-time communications stack embedded in Chromium that handles audio, video, and data channels through SRTP, ICE, and DTLS pipelines, and it runs partially within the GPU process for hardware-accelerated media. The root cause is CWE-125 (Out-of-bounds Read), where the WebRTC code reads memory past the end of an allocated buffer, leaking adjacent heap contents that can be steered into heap corruption. Because the bug is reachable from a renderer or GPU context driven by an attacker-controlled HTML page, it provides a memory disclosure primitive useful for defeating ASLR and for crafting precise heap grooms in a sandbox escape chain. Affected component is Chromium's WebRTC in Chrome prior to 149.0.7827.103 across desktop channels per the Chrome Releases blog.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.103 (stable channel) - upgrade all desktop installs per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html and track upstream details via the Chromium issue tracker entry at https://issues.chromium.org/issues/514671098. Force a browser restart after update since Chrome only loads the new binary on relaunch, and audit Chromium-based products (Edge, Brave, Electron apps) for their corresponding patched builds. As a compensating control until patching completes, restrict or disable WebRTC where it is not business-critical (enterprise policy WebRtcAllowLegacyTLSProtocols / URL-based WebRTC blocking, or extensions like uBlock Origin's 'prevent WebRTC leak' toggle) - trade-off is that video conferencing, voice chat, and some collaboration apps will break. Enforce site isolation and the GPU sandbox (default-on, but verify chrome://gpu) to make the prerequisite 'GPU process compromise' harder to obtain.