What is the CVSS score of EUVD-2026-34509?

EUVD-2026-34509 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by EUVD-2026-34509?

A critical sandbox escape vulnerability in Google Chrome versions prior to 149.0.7827.53 could allow remote attackers to execute arbitrary code on any device running affected versions through a…. A patch is available.

How to fix or mitigate EUVD-2026-34509?

Within 24 hours: Enable or verify Chrome auto-update is active organization-wide; for managed Chrome deployments, initiate immediate distribution of version 149.0.7827.53 or later. Within 7 days: Confirm at least 95% of Chrome instances have been patched; review browser-based activity logs during the pre-patch window for any suspicious behavior. Within 30 days: Complete full patching verification across all Chrome installations and document remediation completion.

Google Chrome EUVD-2026-34509

| CVE-2026-11061 CRITICAL

Out-of-bounds Read (CWE-125)

2026-06-04 chrome-cve-admin@google.com

GHSA-mpxp-vvhq-p258

Information Disclosure Google Buffer Overflow Red Hat Suse Chrome

Critical

Disputed · 9.6 NVD

Severity by source

Sources disagree (Medium–Critical)

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 19:23 vuln.today

CVSS changed

Jun 05, 2026 - 19:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:17 nvd

CRITICAL 9.6

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Type Confusion in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 149.0.7827.53 stems from a type confusion bug in the ANGLE graphics translation layer that a remote attacker can trigger via a crafted HTML page. Despite a CVSS of 9.6 and a vendor-released patch, EPSS is only 0.03% and no public exploit identified at time of analysis, though Chromium-rated Medium browser bugs are routinely targeted once details are public.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chromium's WebGL/WebGPU translation library that converts OpenGL ES API calls into the platform's native graphics API (Direct3D on Windows, Metal on macOS, Vulkan/OpenGL on Linux), and it runs inside the GPU process which historically has weaker sandbox boundaries than the renderer. The CWE-125 (out-of-bounds read) classification combined with the description's 'type confusion' wording indicates the bug confuses one ANGLE object type for another, causing memory reads or interpretation against a structure of incompatible layout - a class commonly leveraged for sandbox escapes because GPU-process compromise crosses the renderer-to-GPU process boundary. The CVSS scope change (S:C) reflects exactly this cross-boundary impact: code that should be confined to the renderer can reach into GPU process privileges.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - update via Chrome's built-in updater (Help > About Google Chrome) and restart the browser, then verify the version string post-update; enterprise fleets should push the update via Group Policy or MDM and force a restart since the fix is not active until the process restarts. Downstream Chromium-based browsers (Edge, Brave, Opera, Electron-bundled apps) should be updated as soon as their respective vendors ship the corresponding ANGLE fix. As a temporary compensating control where patching is delayed, disabling hardware acceleration in chrome://settings reduces the ANGLE attack surface (side effect: degraded video/WebGL performance, higher CPU use), and site isolation plus strict allowlisting of browsable content reduces the chance a user lands on a crafted page; consult the Chrome Releases advisory linked above for full remediation guidance.