What is the CVSS score of EUVD-2026-34486?

EUVD-2026-34486 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by EUVD-2026-34486?

A critical out-of-bounds vulnerability in Google Chrome's media Codecs (CVE-2026-11037, CVSS 9.6) enables attackers to escape the renderer sandbox through crafted video files, potentially…. A patch is available.

How to fix or mitigate EUVD-2026-34486?

Within 24 hours: Issue mandatory Chrome update alert to all end users, emphasizing critical severity and restricting non-updated systems from sensitive workflows where possible. Within 7 days: Verify Chrome installation baseline through endpoint management; forcefully deploy Chrome 149.0.7827.53 or later on all managed devices. Within 30 days: Audit user behavior logs and video file processing for anomalies; confirm 100% patch coverage across the organization.

Google Chrome EUVD-2026-34486

| CVE-2026-11037 CRITICAL

Out-of-bounds Write (CWE-787)

2026-06-04 chrome-cve-admin@google.com

GHSA-x646-ph8g-wp5m

Google Memory Corruption Buffer Overflow Red Hat Suse Chrome

Critical

Disputed · 9.6 NVD

Severity by source

Sources disagree (Medium–Critical)

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 16:23 vuln.today

CVSS changed

Jun 05, 2026 - 16:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

CRITICAL 9.6

DescriptionCVE.org

Out of bounds write in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: Medium)

AnalysisAI

Out-of-bounds write in Google Chrome's media Codecs component prior to version 149.0.7827.53 allows a remote attacker to potentially escape the renderer sandbox via a crafted video file. Successful exploitation requires the victim to load attacker-controlled video content, but the resulting scope change (S:C) means the attacker can break out of Chrome's renderer sandbox and impact resources beyond it. No public exploit has been identified at time of analysis and EPSS is very low (0.03%), but the high CVSS reflects the severe impact of a successful sandbox escape.

Technical ContextAI

The flaw resides in Chrome's Codecs subsystem, which decodes audio/video container formats and bitstreams within the Chromium media pipeline. CWE-787 (Out-of-bounds Write) indicates the decoder writes past the bounds of an allocated buffer - typically caused by malformed length fields, mis-parsed frame headers, or arithmetic errors when processing untrusted video data. Because codec parsing historically runs in privileged media/GPU processes in Chromium (not exclusively the sandboxed renderer), an OOB write here can corrupt memory in a process that has broader OS privileges than the renderer, enabling the sandbox escape primitive described in the advisory. The affected product per the EUVD entry is Chrome desktop builds below 149.0.7827.53; no CPE strings were provided in the input.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - upgrade Stable channel installations to this version or later via the standard auto-update mechanism, and force a relaunch on managed fleets to ensure the fix is loaded (the patched binaries do not take effect until the browser process restarts). Administrators should verify enterprise policies are not pinning Chrome to an older milestone and should monitor Chromium-derived browsers (Edge, Brave, Opera, Electron-based desktop apps) for downstream releases incorporating the same fix. As a compensating control while patching, restrict autoplay of video from untrusted origins via the AutoplayAllowList / DefaultAutoplayPolicy enterprise policies (trade-off: breaks legitimate media sites) and consider disabling hardware-accelerated video decode via --disable-accelerated-video-decode for high-risk users, which forces software decode paths but increases CPU usage and may affect playback smoothness. Vendor advisory: https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html; upstream issue: https://issues.chromium.org/issues/497971287.