What is the CVSS score of EUVD-2026-34696?

EUVD-2026-34696 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by EUVD-2026-34696?

Google Chrome contains a high-severity vulnerability (CVE-2026-11235) affecting all versions prior to 149.0.7827.53 that allows attackers to execute code through malicious webpages accessed by…. A patch is available.

How to fix or mitigate EUVD-2026-34696?

Within 24 hours: Identify and catalog all Chrome installations across the organization; issue security alert to all users. Within 7 days: Deploy Google Chrome version 149.0.7827.53 or later via centralized update mechanisms, prioritizing workstations with access to sensitive systems. Within 30 days: Confirm 100% patch deployment completion and document compliance status for auditable records.

Google Chrome EUVD-2026-34696

| CVE-2026-11235 HIGH

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-2pp6-ppvw-38pj

Google RCE

High

Disputed · 8.8 NVD

Severity by source

Sources disagree (Low–High)

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 03:13 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Insufficient policy enforcement in Compositing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Sandboxed arbitrary code execution in Google Chrome versions prior to 149.0.7827.53 stems from insufficient policy enforcement in the Compositing component, requiring an attacker to first compromise the renderer process before triggering the flaw via a crafted HTML page. Google has released a patched stable channel build and rates the Chromium-internal severity as Low, while NVD scores it CVSS 8.8 due to the network attack vector and high impact triad. No public exploit identified at time of analysis, and SSVC indicates exploitation status 'none' with non-automatable attack characteristics.

Technical ContextAI

The vulnerability resides in Chrome's Compositing subsystem, which is responsible for combining painted layers from web content into the final rendered frame and operates within the sandboxed renderer process boundary. CWE-20 (Improper Input Validation) here manifests as insufficient policy enforcement, meaning the component fails to properly validate or restrict operations that should be governed by Chrome's security policies. Because Compositing runs in the renderer rather than the privileged browser process, the bug alone does not break out of the sandbox; rather, it permits code execution inside the sandbox after the renderer has already been subverted, making this a chain-link bug typically combined with a separate sandbox-escape primitive.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 (stable channel) - update via Chrome's built-in updater or by visiting chrome://settings/help, then relaunch the browser to apply the fix. Enterprise administrators should push the updated MSI/PKG through their managed deployment channels and consult the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for full bulletin details. No standalone workarounds are practical because Compositing is core rendering functionality and cannot be disabled; as a defense-in-depth compensating control until patching completes, consider enforcing site isolation (enabled by default in modern Chrome) and restricting navigation to untrusted sites via enterprise policy URLBlocklist, accepting the trade-off of reduced user productivity on blocked domains. Downstream Chromium-based browsers should be updated as soon as their vendors release rebased builds.