What is the CVSS score of CVE-2026-11682?

CVE-2026-11682 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11682?

A sandbox escape vulnerability in Google Chrome for Linux (CVE-2026-11682) allows attackers who have already compromised the browser's renderer process to escalate access to the underlying system.. A patch is available.

How to fix or mitigate CVE-2026-11682?

Within 24 hours: Inventory all Linux systems running Chrome versions prior to 149.0.7827.103 and assess business criticality. Within 7 days: Deploy Chrome patch 149.0.7827.103 or later to all Linux endpoints via your established browser deployment mechanism. Within 30 days: Verify patch compliance across all Linux workstations and servers, and review browser isolation policies to ensure defense-in-depth protections remain active.

Google Chrome CVE-2026-11682

EUVD-2026-35208 HIGH

Improper Input Validation (CWE-20)

2026-06-09 chrome-cve-admin@google.com

GHSA-v8jq-hgg9-hg9v

Information Disclosure Google

8.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 11:31 vuln.today

CVSS changed

Jun 09, 2026 - 11:22 NVD

8.3 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 8.3

DescriptionCVE.org

Inappropriate implementation in Views in Google Chrome on Linux prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on Linux prior to 149.0.7827.103 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page, escalating from a contained renderer context to broader host access. Chromium rates this High severity, and while no public exploit has been identified at time of analysis, the CVSS 8.3 score reflects the serious consequence of bypassing one of the browser's core security boundaries. The flaw resides in the Views component and requires user interaction (UI:R) plus a prior renderer compromise, making it a second-stage vulnerability in a multi-bug exploit chain.

Technical ContextAI

Views is Chromium's cross-platform UI framework responsible for rendering browser chrome elements such as menus, dialogs, and window decorations, and it runs in the more-privileged browser process rather than the sandboxed renderer. The CWE-20 (Improper Input Validation) classification indicates that Views accepts data or messages from the renderer (typically via Mojo IPC) without adequately validating them, enabling a compromised renderer to influence browser-process behavior in unintended ways. Because the renderer sandbox on Linux uses namespaces and seccomp-bpf to confine untrusted web content, any logic flaw in a cross-process interface like Views becomes a candidate sandbox-escape primitive - turning a renderer RCE into full browser-process code execution.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.103 on Linux - upgrade immediately via the Chrome Releases stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html. For enterprise fleets, push the update through your existing managed-browser channel (Chrome Browser Cloud Management, MDM, or package manager) and verify version compliance with chrome://version. There is no documented standalone workaround for the Views flaw itself, but because exploitation requires a prior renderer compromise, hardening the renderer attack surface helps: enable Site Isolation (default on desktop), keep V8 and Blink current, and consider site-specific extensions like enforced HTTPS-only mode and aggressive ad/script blocking on untrusted sites to reduce the chance of a renderer bug being triggered in the first place. Users of downstream Chromium browsers should track their vendor's corresponding patched release before assuming they are remediated.