What is the CVSS score of CVE-2026-11680?

CVE-2026-11680 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11680?

Windows users running Google Chrome prior to version 149.0.7827.103 are vulnerable to remote code execution through malicious webpages, putting corporate systems and data at risk.. A patch is available.

How to fix or mitigate CVE-2026-11680?

Within 24 hours: Audit Windows systems to identify Chrome installations prior to version 149.0.7827.103. Within 7 days: Deploy Google Chrome version 149.0.7827.103 or later organization-wide and enable automatic updates. Within 30 days: Verify complete patch deployment and audit update logs for successful installations.

Google Chrome CVE-2026-11680

EUVD-2026-35206 HIGH

Use After Free (CWE-416)

2026-06-09 chrome-cve-admin@google.com

GHSA-p222-4qg4-w3mf

Google Memory Corruption RCE Use After Free Microsoft Denial Of Service

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 02:40 vuln.today

CVSS changed

Jun 09, 2026 - 01:22 NVD

8.8 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Media in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome on Windows prior to 149.0.7827.103 allows attackers to run arbitrary code inside the renderer sandbox when a victim visits a crafted HTML page, triggering a use-after-free condition in the Media component. The flaw carries a CVSS 8.8 (High) rating and is tagged by Chromium as High severity. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

The vulnerability resides in Chrome's Media component, which handles audio/video decoding, playback pipelines, and related media stream APIs exposed to web content. The root cause is CWE-416 (Use After Free), a memory-safety class where an object is referenced after its backing memory has been released, allowing an attacker who controls the freed-then-reallocated memory to corrupt program state and hijack control flow. Affected CPE coverage targets Google Chrome on the Windows platform specifically, per the advisory; renderer-process media handling is a historically rich exploit surface because media format parsers and pipeline state machines run with attacker-influenced lifetime semantics.

RemediationAI

Update Google Chrome on Windows to version 149.0.7827.103 or later as released in the Stable Channel update (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html); this is the vendor-released patch and is the primary fix. Enterprises managing Chrome via Group Policy or Chrome Browser Cloud Management should push the update through their MDM/policy channel and verify rollout, since Chrome's auto-update can be delayed by enterprise pinning. As a compensating control until patching completes, restrict browsing to trusted sites via SafeSearch/SmartScreen or proxy-based URL filtering to reduce drive-by exposure, enable Chrome's Site Isolation (default on) so the renderer compromise stays partitioned per origin, and consider temporarily disabling autoplay or media-heavy site categories - the trade-off is broken video/audio on legitimate sites. Do not rely on the renderer sandbox alone as mitigation since a chained sandbox-escape would defeat it.