CVE-2026-11052
A type confusion bug in Chrome’s GPU code on Windows lets a remote attacker escape the browser sandbox if they can trick the renderer into loading a crafted page. The flaw requires the user to open a malicious page and can give the attacker full control over the system. It affects Chrome versions before 149.0.7827.53 on Windows.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Google Chrome on Windows, versions earlier than 149.0.7827.53.
Real-world impact
If an attacker can get a victim to visit a malicious web page, they could break out of Chrome’s sandbox and run arbitrary code on the victim’s computer, potentially taking over the system.
Why this severity
The CVSS score of 9.6 reflects that the attack can be launched over the network, needs no special privileges, requires the user to open a page, and would give the attacker complete confidentiality, integrity, and availability damage.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jun 4, 2026 · Jun 4, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- chromereleases.googleblog.com/2026/06/stable-channel-upda…vendor advisory
- issues.chromium.org/issues/498834967permissions required