What is the CVSS score of EUVD-2026-34563?

EUVD-2026-34563 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by EUVD-2026-34563?

Google Chrome desktop versions before 149.0.7827.53 contain an arbitrary code execution vulnerability (CVE-2026-11102, CVSS 8.8) in the Isolated Web Apps component that executes when users open…. A patch is available.

How to fix or mitigate EUVD-2026-34563?

Within 24 hours: Inventory Chrome versions across managed endpoints; identify all devices running version 149.0.7827.52 or earlier. Within 7 days: Deploy Google Chrome 149.0.7827.53 or later via MDM/auto-update policy; prioritize business-critical and customer-facing systems. Within 30 days: Verify 100% deployment compliance; reinforce user training on risks of opening files from untrusted sources.

Google Chrome EUVD-2026-34563

| CVE-2026-11102 HIGH

Use of Function with Inconsistent Implementations (CWE-474)

2026-06-04 chrome-cve-admin@google.com

GHSA-qmv8-5r2w-3px8

RCE Google

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Red Hat

8.8 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 01:52 vuln.today

CVSS changed

Jun 06, 2026 - 01:52 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionNVD

Inappropriate implementation in Isolated Web Apps in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a malicious file. (Chromium security severity: Medium)

AnalysisAI

Arbitrary code execution within the Chrome sandbox affects Google Chrome desktop builds prior to 149.0.7827.53 due to an inappropriate implementation in the Isolated Web Apps (IWA) component. A remote attacker who convinces a user to open a malicious file can execute code confined to the sandbox process, with no public exploit identified at time of analysis and an EPSS score of only 0.03% (10th percentile) indicating low predicted exploitation likelihood. Google has shipped a fix in the stable channel update for desktop.

Technical ContextAI

Isolated Web Apps are a Chromium feature designed to package web applications with stronger isolation guarantees and elevated platform capabilities, relying on a bundled signed web bundle format and a dedicated process model distinct from regular web origins. The flaw lies in how Chrome's IWA implementation handles a malicious file, allowing the attacker's payload to run inside the renderer/IWA sandbox process - code execution is therefore constrained by Chrome's multi-process sandbox and would normally require a separate sandbox escape bug to achieve full host compromise. No CWE was assigned by NVD, but the wording 'inappropriate implementation' is Chrome's standard label for logic-flaw classes rather than memory corruption, and the affected component is identified via CPE cpe:2.3:a:google:chrome:*.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - update Chrome via the built-in updater or by redeploying managed installers, then restart the browser so the new binaries take effect, per the advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. For fleets that cannot patch immediately, disable the Isolated Web Apps feature via enterprise policy (IsolatedWebAppInstallForceList left empty and the IsolatedWebAppsEnabled / chrome://flags/#enable-isolated-web-apps trial turned off) to remove the affected surface, accepting that any legitimately deployed IWA-packaged internal applications will stop working; additionally, instruct users not to open untrusted files via the browser and consider tightening email/web gateway file-type filtering to reduce the chance of the malicious-file delivery vector. Track downstream Chromium-based browsers (Edge, Brave, Opera) for their respective security updates incorporating the same fix.