CVE-2026-11047
A flaw in Google Chrome on Windows lets a remote attacker escape the browser sandbox if they already control the renderer process. By loading a specially crafted HTML page, the attacker could gain full system access. The issue is fixed in Chrome 149.0.7827.53 and later.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Google Chrome browsers on Windows versions before 149.0.7827.53. Typical users are anyone running an older Chrome installation on a Windows PC.
Real-world impact
An attacker who can trick a user into opening a malicious web page could break out of Chrome’s sandbox and run arbitrary code on the victim’s computer, potentially taking full control of the system.
Why this severity
The CVSS score is high because the vulnerability can be triggered remotely over the network, requires no special privileges, and allows an attacker to compromise confidentiality, integrity, and availability of the system.
What to do about it
- 01Upgrade Google Chrome to version 149.0.7827.53 or newer.
- 02Restart the browser after the update.
NVD description
Timeline
- Jun 4, 2026 · Jun 4, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
- Jul 24, 2026 · 11d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- chromereleases.googleblog.com/2026/06/stable-channel-upda…vendor advisory
- issues.chromium.org/issues/498768132permissions required