CVE-2026-11120
Google Chrome had a flaw that let a malicious web page escape the browser sandbox if the attacker already had control of the renderer process. The bug was due to insufficient validation of untrusted input in Enterprise Reporting. It could allow attackers to gain full system access.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Google Chrome users on versions older than 149.0.7827.53, especially those using Enterprise Reporting features.
Real-world impact
An attacker could escape the browser sandbox and execute arbitrary code on the victim’s machine, potentially taking full control of the system.
Why this severity
The CVSS score of 9.6 reflects that the vulnerability can be exploited remotely with no authentication, requires only a compromised renderer process, and gives attackers full control over the system.
What to do about it
- 01Upgrade Google Chrome to version 149.0.7827.53 or later.
- 02Restart the browser.
NVD description
Timeline
- Jun 4, 2026 · Jun 4, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
- Jul 24, 2026 · 11d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- chromereleases.googleblog.com/2026/06/stable-channel-upda…release notes
- issues.chromium.org/issues/501467566permissions required