What is the CVSS score of EUVD-2026-34652?

EUVD-2026-34652 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by EUVD-2026-34652?

Google Chrome's memory corruption vulnerability (CVE-2026-11191) affects all employees using unpatched versions and enables attackers to steal sensitive data or disrupt browser functionality by…. A patch is available.

How to fix or mitigate EUVD-2026-34652?

24 hours: Inventory all Chrome browser versions across enterprise systems. 7 days: Deploy Google Chrome 149.0.7827.53 or later to all endpoints via patch management; enable automatic updates if not already configured. 30 days: Conduct compliance audit to verify 100% adoption and implement Chrome version controls in endpoint policies.

Google Chrome EUVD-2026-34652

| CVE-2026-11191 HIGH

Out-of-bounds Read (CWE-125)

2026-06-04 chrome-cve-admin@google.com

GHSA-r79w-gpv4-pww2

Information Disclosure Google Buffer Overflow

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

6.3 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 16:24 vuln.today

CVSS changed

Jun 05, 2026 - 16:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Out of bounds memory access in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Out-of-bounds memory access in the ANGLE graphics translation layer of Google Chrome before 149.0.7827.53 allows a remote attacker to read or corrupt memory by luring a user to a crafted HTML page. The flaw carries a CVSS 8.8 rating due to high impact on confidentiality, integrity, and availability, though Chromium rates the security severity as Medium and EPSS is very low (0.03%). No public exploit identified at time of analysis, and the issue is not on the CISA KEV list.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is the abstraction layer Chrome uses to translate WebGL and other OpenGL ES API calls onto the host platform's native graphics APIs (Direct3D on Windows, Metal on macOS, Vulkan/OpenGL on Linux). The CWE-125 (Out-of-bounds Read) class typically arises when GPU command or shader processing fails to validate buffer indices or sizes derived from web-supplied content, allowing memory adjacent to a legitimate allocation to be accessed. Because ANGLE runs inside the Chrome GPU process, OOB issues here can leak sensitive process memory or, when chained with adjacent corruption primitives, contribute to sandbox-aware exploitation.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - upgrade Chrome Stable to 149.0.7827.53 or later via the built-in updater or enterprise deployment tooling, then restart the browser to load the fixed binaries; the advisory is published at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and the underlying bug is tracked at https://issues.chromium.org/issues/503392431. Administrators of Chromium-based browsers (Edge, Brave, Opera, Vivaldi) should monitor their vendors' channels and apply the corresponding ANGLE update. If patching must be deferred, compensating controls include disabling hardware-accelerated WebGL via the chrome://flags 'Override software rendering list' / 'WebGL' settings or the DisableWebGL/Hardware acceleration enterprise policies - this blocks the ANGLE code path most likely to reach the bug but will break legitimate WebGL/Canvas-accelerated sites and degrade graphics performance for video and maps. Strict URL allowlisting via SafeSites or web proxy filtering reduces exposure to crafted hostile pages at the cost of operational overhead.