What is the CVSS score of CVE-2026-11672?

CVE-2026-11672 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11672?

Google Chrome on Android prior to version 149.0.7827.103 contains a sandbox escape vulnerability that enables attackers to escalate from browser compromise to complete device takeover, exposing all…. A patch is available.

How to fix or mitigate CVE-2026-11672?

Within 24 hours: Deploy notification to all Android users and inventory devices running Chrome prior to version 149.0.7827.103. Within 7 days: Enforce deployment of Chrome 149.0.7827.103 or later across all Android endpoints via MDM policy. Within 30 days: Verify 100% update compliance and implement continuous enforcement of automatic security updates.

Google Chrome CVE-2026-11672

EUVD-2026-35272 HIGH

Out-of-bounds Write (CWE-787)

2026-06-09 chrome-cve-admin@google.com

GHSA-73ch-5vqp-j2j9

Google Memory Corruption Buffer Overflow

8.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 11:28 vuln.today

CVSS changed

Jun 09, 2026 - 11:22 NVD

8.3 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 8.3

DescriptionCVE.org

Heap buffer overflow in GPU in Google Chrome on Android prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on Android prior to 149.0.7827.103 allows a remote attacker who has already compromised the renderer process to break out of Chrome's sandbox via a heap buffer overflow in the GPU process triggered by a crafted HTML page. Rated High severity by Chromium with a CVSS 8.3 reflecting scope change and full CIA impact; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

The flaw is an out-of-bounds write (CWE-787) in Chrome's GPU process on Android. The GPU process is a privileged Chromium component that brokers hardware-accelerated rendering for the sandboxed renderer; memory corruption there is a classic pivot for sandbox escapes because the GPU process runs at a higher privilege than the renderer. The crafted HTML page presumably reaches a GPU command or shader-handling path (e.g., WebGL/Skia/ANGLE-style surfaces) that mishandles heap buffer sizing, enabling controlled writes beyond an allocation. Chromium tracker issues.chromium.org/issues/516794471 and the Chrome Releases advisory document the fix in 149.0.7827.103.

RemediationAI

Vendor-released patch: Chrome for Android 149.0.7827.103 - upgrade via Google Play to that version or later as documented in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html. For managed Android fleets, push the update through MDM/Managed Google Play and verify chrome://version on a sample of devices; for enterprise users on Chrome Browser Cloud Management, confirm the auto-update rollout has reached affected endpoints. No vendor-documented workaround exists for the GPU flaw itself, but because exploitation requires a prior renderer compromise, interim compensating controls include restricting browsing to trusted origins via enterprise URL allowlists, disabling unnecessary GPU-accelerated features such as WebGL through the 'Disable3DAPIs' policy (trade-off: breaks WebGL-dependent sites and degrades rendering performance), and enabling Site Isolation and Strict Site Isolation policies if not already on by default.