What is the CVSS score of EUVD-2026-35276?

EUVD-2026-35276 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by EUVD-2026-35276?

Google Chrome and ChromeOS on Linux (prior to version 149.0.7827.103) contain a sandbox escape vulnerability in the WebGPU component that could enable privilege escalation if the browser process is…. A patch is available.

How to fix or mitigate EUVD-2026-35276?

Within 24 hours: Inventory all Chrome and ChromeOS Linux deployments and document current versions. Within 7 days: Deploy Chrome version 149.0.7827.103 or later across all Linux systems, prioritizing machines with elevated access or sensitive data handling. Within 30 days: Verify patch deployment across all Chrome and ChromeOS Linux endpoints and ensure no systems remain on vulnerable versions.

Google Chrome EUVD-2026-35276

| CVE-2026-11676 HIGH

Improper Input Validation (CWE-20)

2026-06-09 chrome-cve-admin@google.com

GHSA-68c4-77cf-437j

Information Disclosure Google

8.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 11:29 vuln.today

CVSS changed

Jun 09, 2026 - 11:22 NVD

8.3 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 8.3

DescriptionCVE.org

Insufficient validation of untrusted input in Dawn in Google Chrome on Linux and ChromeOS prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome and ChromeOS on Linux prior to 149.0.7827.103 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page abusing the Dawn (WebGPU) component. Chromium rates the severity High, and while no public exploit identified at time of analysis, sandbox-escape bugs in Dawn are historically chained with renderer RCE bugs in exploit chains. The CVSS 8.3 score reflects the high attack complexity and required user interaction, but the scope change (S:C) signals a meaningful trust-boundary break.

Technical ContextAI

Dawn is Chromium's open-source implementation of the WebGPU standard, providing a cross-platform abstraction over native GPU APIs (Vulkan on Linux/ChromeOS). It runs partially in the GPU process, which sits outside the renderer sandbox and has broader privileges. The root cause is CWE-20 (Improper Input Validation): Dawn fails to sufficiently validate data received from a compromised renderer, allowing crafted input across the IPC boundary to corrupt state in the more-privileged GPU process. Affected CPE space covers Chrome and ChromeOS builds prior to 149.0.7827.103 on Linux platforms specifically.

RemediationAI

Vendor-released patch: Chrome 149.0.7827.103 on Linux and the corresponding ChromeOS stable-channel build - upgrade immediately per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html). For managed fleets, push the update via enterprise policy and verify the browser version post-deployment; ChromeOS devices should receive the update automatically but admins should confirm the rollout has reached all channels. As a temporary compensating control on unpatched endpoints, WebGPU/Dawn can be disabled by setting the enterprise policy 'DefaultWebGpuSetting' to blocked or launching with --disable-features=WebGPU, which removes the attack surface entirely at the cost of breaking WebGPU-dependent sites (currently a small but growing set including some 3D and ML web apps). Restricting users to vetted sites via SafeSites or proxy policies further reduces the chance of encountering the malicious HTML required to trigger the bug.