CVE-2026-11041

chromium-browser: Insufficient validation of untrusted input in Media

View on CVE.org
Published Jun 4, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Description
Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

Analysis

AI-generated

Technical impact

Insufficient validation of untrusted input in the Media module of Google Chrome on Windows permits a remote attacker who has already compromised the renderer process to craft an HTML page that may escape the browser sandbox. The vulnerability arises from inadequate input validation (CWE‑20) and weaknesses in media handling that allow the sandbox to be bypassed (CWE‑1286). No additional capabilities beyond breaking out of the sandbox are specified in the description.

Affected Systems

Google Chrome for Windows users running any version before 149.0.7827.53 are affected. The issue applies to the Windows rendering engine and media handling components in these releases.

Risk and Exploitability

The CVSS score of 8.8 classifies the issue as high severity, while the EPSS score of < 1% indicates a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog and no public exploits are known. With the requirement that the attacker already control the renderer process, remediation of the flaw remains a high priority due to the potential for a sandbox escape.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 149.0.7827.53 or later.
  • If an immediate upgrade is not possible, configure enterprise policies or extensions to restrict or disable media content in untrusted HTML pages.
  • Monitor renderer process activity for anomalous behavior that could indicate a sandbox escape attempt.

Generated by OpenCVE AI on June 8, 2026 at 14:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DSA Debian DSA DSA-6325-1 chromium security update
History
Type Values Removed Values Added
First Time appeared Microsoft
Microsoft windows
Weaknesses NVD-CWE-noinfo
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft windows
Type Values Removed Values Added
Title chromium-browser: Insufficient validation of untrusted input in Media
Weaknesses CWE-1286
References
Metrics threat_severity

None

 threat_severity

Moderate
Type Values Removed Values Added
Title Insufficient Input Validation in Chrome Media Allows Potential Sandbox Escapes
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome
Type Values Removed Values Added
Title Insufficient Input Validation in Chrome Media Allows Potential Sandbox Escapes
Type Values Removed Values Added
Description Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-20
References
Earlier changes (2)
Weaknesses

Sources

Status
PUBLISHED
Assigner
Chrome
Published
Updated
Jun 5, 2026, 6:01 PM
Reserved
Jun 4, 2026, 5:06 PM

View source JSON

Updated
Jun 5, 2026, 5:58 PM

JSON

Status
Analyzed
Published
Jun 4, 2026, 11:17 PM
Modified
Jul 23, 2026, 6:10 AM

View source JSON

Severity
Moderate
Public date
Jun 2, 2026, 12:00 AM

View source Bugzilla JSON

Updated
Jun 8, 2026, 2:45 PM

JSON