What is the CVSS score of CVE-2026-11692?

CVE-2026-11692 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11692?

Google Chrome versions prior to 149.0.7827.103 contain a high-severity vulnerability (CVE-2026-11692, CVSS 8.3) enabling attackers to bypass Chrome sandbox protections and access system resources.. A patch is available.

How to fix or mitigate CVE-2026-11692?

Within 24 hours: Identify all systems running Chrome versions prior to 149.0.7827.103 and assess deployment scope. Within 7 days: Deploy Chrome 149.0.7827.103 or later to all affected endpoints through standard change management; prioritize systems accessible to high-risk user groups. Within 30 days: Verify 100% patch compliance and confirm no older versions remain operational.

Google Chrome CVE-2026-11692

EUVD-2026-35218 HIGH

Use After Free (CWE-416)

2026-06-09 chrome-cve-admin@google.com

GHSA-78gr-622p-8fm9

Denial Of Service Use After Free Memory Corruption Google

8.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 02:38 vuln.today

CVSS changed

Jun 09, 2026 - 02:22 NVD

8.3 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in Read Anything in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 149.0.7827.103 allows remote attackers who have already compromised the renderer process to break out of the sandbox via a use-after-free in the Read Anything component when processing a crafted HTML page. Google rates this Chromium-severity High, and no public exploit has been identified at time of analysis, but the CVSS 8.3 score reflects the severity of full sandbox escape leading to scoped impact beyond the renderer. This is a second-stage bug requiring chaining with a renderer compromise, not a one-shot drive-by.

Technical ContextAI

The flaw is a CWE-416 (Use After Free) memory corruption issue in Chrome's Read Anything feature, an accessibility/reading-mode component that processes page content in the renderer process to extract readable text. Use-after-free conditions occur when freed heap memory is later dereferenced, enabling attackers to control object layout and hijack execution flow. Because this bug lives in code reachable across the renderer-to-broker IPC boundary, exploitation can transition control from the sandboxed renderer to a higher-privileged Chrome process, which is the explicit sandbox escape primitive described. Affected component is Chromium-based Google Chrome desktop builds before 149.0.7827.103.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.103 - update Chrome via Help > About Google Chrome and relaunch the browser, or push the update through enterprise management (Chrome Browser Cloud Management, Group Policy auto-update). Refer to the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html and the upstream bug tracker entry at https://issues.chromium.org/issues/517607902. For downstream Chromium browsers, apply vendor updates as soon as they ship the merged fix. If immediate patching is not possible, compensating controls include disabling the Read Anything / reading-mode feature via enterprise policy where supported (trade-off: loss of accessibility functionality for users who rely on it), and restricting browsing to known-good sites via web filtering to reduce exposure to crafted HTML payloads (trade-off: operational friction, no protection against compromised legitimate sites).