What is the CVSS score of CVE-2026-11683?

CVE-2026-11683 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11683?

Google Chrome contains a high-severity remote code execution vulnerability (CVSS 8.8) that could allow attackers to compromise employee systems through malicious websites, potentially leading to data…. A patch is available.

How to fix or mitigate CVE-2026-11683?

Within 24 hours: Identify Chrome deployments across the organization and initiate patching preparation; notify stakeholders of required updates. Within 7 days: Deploy Google Chrome version 149.0.7827.103 or later to all managed systems via endpoint management tools; provide update guidance to users with unmanaged devices. Within 30 days: Verify complete patching compliance through security audits, enable auto-update policies to prevent future delays, and review logs for any exploitation attempts.

Google Chrome CVE-2026-11683

EUVD-2026-35209 HIGH

Use After Free (CWE-416)

2026-06-09 chrome-cve-admin@google.com

GHSA-282g-w5fh-9q49

Google Memory Corruption RCE Use After Free Denial Of Service

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 02:40 vuln.today

CVSS changed

Jun 09, 2026 - 01:22 NVD

8.8 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in WebCodecs in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome versions prior to 149.0.7827.103 allows attackers to execute arbitrary code within the browser sandbox by luring users to a malicious HTML page that triggers a use-after-free in the WebCodecs component. Chromium rates this as High severity with a CVSS score of 8.8, and while a vendor patch is available, no public exploit has been identified at time of analysis. Exploitation requires user interaction (visiting a crafted page), which moderates real-world risk somewhat but still places this in the high-priority browser-patching tier.

Technical ContextAI

WebCodecs is a Chromium web platform API that exposes low-level audio and video encoder/decoder primitives to JavaScript, used for streaming, video conferencing, and media processing in the browser. The root cause is CWE-416 (Use-After-Free), a memory-safety class bug where memory is referenced after being freed - in WebCodecs this typically arises from object lifetime mismanagement between JavaScript handles and the underlying C++ codec objects. Successful exploitation of such bugs in Chromium's renderer process commonly leads to attacker-controlled code execution constrained by the sandbox, which is why the description specifically notes 'inside a sandbox' - a separate sandbox escape would be required for full host compromise.

RemediationAI

Vendor-released patch: update Google Chrome to 149.0.7827.103 or later on the Stable channel by allowing Chrome's auto-update mechanism to run and then restarting the browser; for enterprises, push the update via your management tooling (Chrome Browser Cloud Management, Group Policy 'TargetVersionPrefix', Jamf, Intune, or equivalent) and verify rollout. Refer to the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html for full details. Users of Chromium-derived browsers (Edge, Brave, Opera, Vivaldi) should apply their respective vendor updates once those vendors merge the upstream fix. As a compensating control until patching is complete, administrators can disable the WebCodecs API for untrusted origins via enterprise policy or extension-based content blocking (trade-off: breaks video-conferencing, streaming, and other media-heavy web apps that depend on hardware-accelerated codec access), and/or enforce strict site-isolation and stricter SafeBrowsing policies to reduce the chance users reach attacker-controlled HTML pages.