CVE-2026-11021
A flaw in Chrome’s GPU code on Windows lets a remote attacker escape the browser sandbox if they already control the renderer process. By loading a specially crafted web page, the attacker could potentially gain full system access. The issue affects Chrome versions before 149.0.7827.53 on Windows.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Google Chrome on Windows, versions earlier than 149.0.7827.53. Typical users are Windows PC owners who have not updated Chrome.
Real-world impact
If an attacker can run malicious code in the renderer, they could break out of the browser sandbox and execute arbitrary code on the victim’s computer, potentially taking control of the system.
Why this severity
The CVSS score of 9.6 reflects that the vulnerability can be triggered over the network, requires no special privileges, and gives an attacker complete confidentiality, integrity, and availability compromise once exploited. The low attack complexity and lack of required privileges make it highly dangerous.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jun 4, 2026 · Jun 4, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 22, 2026 · 13d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- chromereleases.googleblog.com/2026/06/stable-channel-upda…release notesvendor advisory
- issues.chromium.org/issues/497487755permissions required