What is the CVSS score of CVE-2026-11677?

CVE-2026-11677 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11677?

Google Chrome on macOS (versions prior to 149.0.7827.103) contains a sandbox escape vulnerability that allows attackers who have already compromised the browser's renderer process to break out of the…. A patch is available.

How to fix or mitigate CVE-2026-11677?

Within 24 hours: Inventory all macOS systems running Chrome versions prior to 149.0.7827.103 and assess deployment readiness. Within 7 days: Deploy Chrome version 149.0.7827.103 or later to pilot/non-production systems and validate compatibility with business applications. Within 30 days: Complete mandatory rollout of Chrome 149.0.7827.103 or later to all production macOS systems and verify update completion across the fleet.

Google Chrome CVE-2026-11677

EUVD-2026-35203 HIGH

Race Condition (CWE-362)

2026-06-09 chrome-cve-admin@google.com

GHSA-prmr-q74g-m753

Information Disclosure Google Race Condition

8.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

7.3 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 11:30 vuln.today

CVSS changed

Jun 09, 2026 - 11:22 NVD

8.3 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 8.3

DescriptionCVE.org

Race in Network in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker who had compromised the network process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on macOS versions prior to 149.0.7827.103 allows a remote attacker who has already compromised the renderer/network process to break out of the browser sandbox via a race condition triggered by a crafted HTML page. Chromium rates the severity as High and a vendor patch is available, though no public exploit has been identified at time of analysis.

Technical ContextAI

The flaw lives in Chrome's Network service component on macOS, which runs in a sandboxed process as part of Chromium's multi-process site isolation architecture. CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization, i.e. a race condition) indicates that two or more concurrent code paths in the Network process access shared state without adequate locking, creating a window in which an attacker who already controls that process can manipulate state to violate sandbox boundaries. Successful exploitation undermines the renderer/network sandbox, which is the last line of defense before host-level code execution on macOS.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.103 or later for macOS - upgrade via Chrome's built-in updater or by relaunching the browser, and verify the version under chrome://settings/help. Enterprises managing Chrome with policy should push the updated MSI/PKG through their endpoint management tooling and confirm rollout on Mac fleets; see the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html. No formal workaround is published; as a compensating control until patching completes, restrict browsing of untrusted content on Mac endpoints (e.g., enforce SafeSearch/URL allowlists or route browsing through a remote-browser isolation gateway), accepting the productivity trade-off, since the bug requires the user to load a crafted HTML page.