What is the CVSS score of CVE-2026-11671?

CVE-2026-11671 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11671?

Google Chrome versions before 149.0.7827.103 contain a critical vulnerability allowing remote system compromise through malicious webpages.. A patch is available.

How to fix or mitigate CVE-2026-11671?

24 hours: Issue organization-wide alert and prepare Chrome 149.0.7827.103 or later for deployment. 7 days: Deploy Chrome 149.0.7827.103 or later across all systems through patch management tools. 30 days: Verify deployment completion and audit all endpoints for vulnerable Chrome versions.

Google Chrome CVE-2026-11671

EUVD-2026-35271 CRITICAL

Use After Free (CWE-416)

2026-06-09 chrome-cve-admin@google.com

GHSA-93cq-cwfp-9r89

Denial Of Service Use After Free Memory Corruption Google

9.6

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 02:43 vuln.today

CVSS changed

Jun 09, 2026 - 02:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

CRITICAL 9.6

DescriptionCVE.org

Use after free in Navigation in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Articles & Coverage 1

News Critical Sandbox Escape in Google Chrome before 149.0.7827.103 - CVE-2026-11671 Jun 09, 2026

AnalysisAI

Sandbox escape in Google Chrome before 149.0.7827.103 allows a remote attacker to break out of the renderer sandbox through a use-after-free in the Navigation component when a victim visits a crafted HTML page. The CVSS 9.6 score reflects a scope-changing impact on confidentiality, integrity, and availability with only user interaction (visiting a page) required, and no public exploit was identified at time of analysis.

Technical ContextAI

The vulnerability lives in Chromium's Navigation subsystem, which orchestrates the lifecycle of frames, documents, and cross-origin transitions across the multi-process browser architecture. CWE-416 (Use After Free) indicates that a Navigation object is freed while another code path still holds a dangling reference, allowing an attacker to reclaim the freed memory with controlled data and influence subsequent dereferences. Because Navigation runs across the boundary between the renderer and browser processes, corrupting these structures gives an attacker a pivot to escape the renderer sandbox and reach the more privileged browser process, which has broader access to the host OS.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.103 (Stable channel) - upgrade all desktop Chrome installations to this version or later via the Stable Channel Update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html, and restart the browser to load the new binary. Enterprises managing Chrome via group policy or MDM should force-update and verify chrome://version on a sample of endpoints. For downstream Chromium-based browsers, apply the corresponding vendor build that incorporates the Chromium fix. If patching must be delayed, compensating controls include enabling Site Isolation (default on desktop but worth verifying), enforcing Enhanced Safe Browsing, and restricting browsing to trusted domains via enterprise policy URLBlocklist/URLAllowlist - note these reduce but do not eliminate exposure since any crafted HTML page rendered by the affected version can trigger the bug.