What is the CVSS score of CVE-2026-11697?

CVE-2026-11697 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11697?

Google Chrome versions prior to 149.0.7827.103 contain a critical sandbox escape vulnerability (CVSS 9.6) that breaks Chrome's renderer sandbox security boundary.. A patch is available.

How to fix or mitigate CVE-2026-11697?

Within 24 hours: Audit Chrome deployment across your environment and prepare patch deployment to version 149.0.7827.103 or later. Within 7 days: Deploy Chrome 149.0.7827.103+ to all systems and users. Within 30 days: Verify 100% patch adoption, review deployment logs, and establish monitoring for exploitation indicators.

Google Chrome CVE-2026-11697

EUVD-2026-35223 CRITICAL

Improper Input Validation (CWE-20)

2026-06-09 chrome-cve-admin@google.com

GHSA-rxx6-vjpq-6755

Information Disclosure Google

9.6

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 11:31 vuln.today

CVSS changed

Jun 09, 2026 - 11:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

CRITICAL 9.6

DescriptionCVE.org

Insufficient validation of untrusted input in UI in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome prior to 149.0.7827.103 allows a remote attacker to break out of the browser's renderer sandbox via a crafted HTML page that exploits insufficient input validation in the UI layer. The scope-changing CVSS 9.6 reflects that successful exploitation crosses the sandbox security boundary, though user interaction (visiting a malicious page) is required. No public exploit identified at time of analysis and the issue is not currently listed in CISA KEV, but Google rates the underlying Chromium severity as High.

Technical ContextAI

Google Chrome relies on a multi-process sandbox architecture in which renderer processes handling untrusted web content are isolated from the privileged browser process and the host OS. This issue (CWE-20: Improper Input Validation) resides in the browser's UI handling code, meaning data originating from a web page is not adequately sanitized before being consumed by a higher-privilege UI component. Because the flaw allows code or actions in a low-privilege renderer/web context to influence a more privileged process, it produces a sandbox escape - the scope change (S:C) in the CVSS vector reflects this crossing of the sandbox trust boundary.

RemediationAI

Upgrade Google Chrome to version 149.0.7827.103 or later on all desktop platforms; this is the vendor-released patch identified in the Chrome Releases stable-channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html. Trigger Chrome's built-in updater (chrome://settings/help) or push updates via enterprise management (Google Admin Console, GPO, MDM) and require a browser restart to apply. No vendor workaround is published; until patched, compensating controls include enforcing site isolation (already default), restricting browsing to allow-listed sites via enterprise policy URLAllowlist/URLBlocklist, deploying an extension content-policy that blocks unknown JavaScript, or routing browsing through a remote browser isolation (RBI) service - each reduces exposure at the cost of breaking legitimate sites or adding latency. Downstream Chromium-based browser users should monitor and apply their own vendor's corresponding release.