What is the CVSS score of CVE-2026-11679?

CVE-2026-11679 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11679?

Google Chrome on Windows before version 149.0.7827.103 contains a vulnerability that attackers could exploit to take control of affected systems and steal sensitive data; no public exploit has been…. A patch is available.

How to fix or mitigate CVE-2026-11679?

Within 24 hours: Inventory all Windows systems running Google Chrome and document current versions. Within 7 days: Deploy vendor patch-Chrome 149.0.7827.103 or later-across all Windows systems via your endpoint management tools. Within 30 days: Audit for 100% patch compliance organization-wide and enforce automatic Chrome updates.

Google Chrome CVE-2026-11679

EUVD-2026-35205 HIGH

Use After Free (CWE-416)

2026-06-09 chrome-cve-admin@google.com

GHSA-2jmx-42pw-22v9

Google Memory Corruption Use After Free Microsoft Denial Of Service

8.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 02:42 vuln.today

CVSS changed

Jun 09, 2026 - 02:22 NVD

8.3 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in Codecs in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on Windows before 149.0.7827.103 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a use-after-free in the Codecs component triggered by a crafted HTML page. Google rates this Chromium security severity as High, and a vendor patch is available; no public exploit was identified at time of analysis, though the scope-changed CVSS 8.3 reflects the cross-boundary impact of breaching the sandbox.

Technical ContextAI

The flaw resides in the Codecs subsystem of Chromium's media stack, which decodes audio/video content within the renderer process. CWE-416 (Use After Free) means memory is freed while a dangling pointer remains reachable, allowing an attacker to influence the freed allocation and corrupt control or data structures when the pointer is dereferenced. In Chrome's multi-process architecture, the renderer is normally confined by the OS sandbox; a UAF reachable in higher-privileged code paths invoked from a compromised renderer can be chained to cross the sandbox boundary on Windows, where this issue is specifically scoped per the advisory.

RemediationAI

Vendor-released patch: Chrome 149.0.7827.103 for Windows - upgrade immediately via the Chrome Releases stable channel update at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html, and validate enterprise rollout through Google Update / managed deployment channels. For managed fleets, force a relaunch policy so the new build is actually loaded rather than sitting staged. Until patched endpoints are confirmed, compensating controls include enforcing Site Isolation (default but verify via chrome://flags and policy), disabling unnecessary media codecs is not generally configurable in Chrome so it is not a practical workaround, and restricting browsing to trusted destinations via SafeBrowsing Enhanced Protection plus a web proxy/DNS filter to reduce the chance of users loading attacker-controlled HTML; note these only reduce exposure and do not eliminate the underlying UAF. Downstream Chromium-based browsers (Edge, Brave, Opera, Electron apps) should be tracked separately for their respective backports.