CVE-2026-11146
A flaw in Google Chrome’s Chromoting component lets a remote attacker escape the browser sandbox if they can trick the renderer process into loading a specially crafted HTML page. The bug is only present in Chrome versions before 149.0.7827.53 and requires the user to open the malicious page. It could let an attacker gain full control of the affected machine.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Google Chrome on Windows, macOS, and Linux, any version earlier than 149.0.7827.53.
Real-world impact
An attacker who can trick a user into opening a malicious page could break out of Chrome’s sandbox and execute code with the same privileges as the user, potentially taking over the computer.
Why this severity
The CVSS score of 9.6 reflects that the vulnerability can be exploited over the network, needs no special privileges, requires the user to open a crafted page, and would give an attacker full confidentiality, integrity, and availability compromise.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jun 4, 2026 · Jun 4, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- chromereleases.googleblog.com/2026/06/stable-channel-upda…vendor advisory
- issues.chromium.org/issues/501709220permissions required