What is the CVSS score of CVE-2026-11700?

CVE-2026-11700 has a contested CVSS base score of 8.3 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11700?

Google Chrome versions prior to 149.0.7827.103 contain a sandbox escape vulnerability (CVE-2026-11700) that allows compromised renderer processes to achieve code execution at the browser level-a…. A patch is available.

How to fix or mitigate CVE-2026-11700?

24 hours: Alert stakeholders, identify Chrome deployment scope, verify patch availability in your environment. 7 days: Deploy Chrome 149.0.7827.103 or later to all systems; prioritize administrative and development workstations. 30 days: Complete enterprise-wide rollout with verification that all instances have updated to 149.0.7827.103 or later; maintain deployment automation to prevent version regression.

Google Chrome CVE-2026-11700

EUVD-2026-35226 HIGH

Use After Free (CWE-416)

2026-06-09 chrome-cve-admin@google.com

GHSA-gpxh-m862-v6vq

Denial Of Service Use After Free Memory Corruption Google

High

Disputed · 8.3 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 02:35 vuln.today

CVSS changed

Jun 09, 2026 - 02:22 NVD

8.3 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in Tracing in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome prior to 149.0.7827.103 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a use-after-free flaw in the Tracing component, triggered through a crafted HTML page. No public exploit identified at time of analysis, and SSVC indicates exploitation status is 'none', but the technical impact is rated total because a successful escape grants code execution at browser-process privileges. Google has shipped a fix and rates the underlying Chromium severity as Medium, while the assigned CVSS is 8.3 due to scope change and high CIA impact.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chromium's Tracing subsystem, the instrumentation framework (TraceEvent/Perfetto-backed) used to record performance and diagnostic events across Chrome processes. Use-after-free conditions occur when a freed object's memory is reused while a dangling pointer still references it, which an attacker can groom to gain control of a function pointer or vtable. Because Tracing exposes IPC surface reachable from the renderer, an attacker who already has code execution in the renderer (typically via a prior renderer RCE such as a V8 bug) can drive the Tracing logic in the privileged browser process to free and reuse an object, escaping the renderer sandbox. The affected component is the Chromium browser engine, used by Chrome and many downstream Chromium-based browsers.

RemediationAI

Update Google Chrome to version 149.0.7827.103 or later on Windows, macOS, and Linux via the stable-channel update described at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html - this is the vendor-released patch and the primary fix. Verify the running version via chrome://settings/help and restart the browser to apply the update; in managed environments push the update through Chrome Browser Cloud Management, Group Policy, or the platform package manager. Downstream Chromium-based browsers should be updated as soon as their vendors rebase onto patched Chromium, and embedded runtimes such as Electron and CEF should be upgraded to releases that pick up the fix. As a compensating control while patching, site isolation should be left at its default enabled state (it does not block this bug but constrains what a compromised renderer can reach), and high-risk users can be moved into restrictive profiles or browse with extensions like NoScript/uBlock Origin to reduce exposure to untrusted HTML - at the cost of breaking many sites. Disabling the Tracing subsystem is not a supported user-facing configuration and is not a viable workaround.