CVE-2026-11047

chromium-browser: Insufficient validation of untrusted input in Base

View on CVE.org
Published Jun 4, 2026 CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Description
Inappropriate implementation in Base in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

Analysis

AI-generated

Technical impact

A flaw in the Base component of Google Chrome on Windows allows an attacker who has already compromised the renderer process to serve a specially crafted HTML page that can escape the browser sandbox. The weakness is an input validation failure (CWE‑20) and involves an improper privilege handling (CWE‑266), which can enable an attacker to gain elevated privileges and potentially compromise the entire system.

Affected Systems

Google Chrome installed on Windows operating systems, for versions on the stable channel earlier than 149.0.7827.53.

Risk and Exploitability

The vulnerability was scored 9.6 on the CVSS scale, indicating high severity. The EPSS score is below 1 %, suggesting a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers must first gain control of the renderer process—typically through a malicious website or compromised plugin—before delivering the malicious HTML, which limits the breadth of exploitation but still poses a significant risk when achieved.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 149.0.7827.53 or newer on all Windows systems.
  • Disable or remove all third‑party extensions and plug‑ins that run within the renderer process to reduce the chance of initial compromise.
  • Enable Chrome’s Safe Browsing and other built‑in protection features to detect and block malicious HTML content.

Generated by OpenCVE AI on June 7, 2026 at 14:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DSA Debian DSA DSA-6325-1 chromium security update
History
Type Values Removed Values Added
First Time appeared Microsoft
Microsoft windows
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft windows
Type Values Removed Values Added
Title chromium-browser: Insufficient validation of untrusted input in Base
Weaknesses CWE-266
References
Metrics threat_severity

None

 threat_severity

Moderate
Type Values Removed Values Added
Title Browser-based Sandbox Escape via Crafted HTML in Chrome on Windows
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome
Type Values Removed Values Added
Title Browser-based Sandbox Escape via Crafted HTML in Chrome on Windows
Type Values Removed Values Added
Description Inappropriate implementation in Base in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-20
References
Earlier changes (2)
Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-266

    Incorrect Privilege Assignment

Sources

Status
PUBLISHED
Assigner
Chrome
Published
Updated
Jun 5, 2026, 7:08 PM
Reserved
Jun 4, 2026, 5:06 PM

View source JSON

Updated
Jun 5, 2026, 7:05 PM

JSON

Status
Analyzed
Published
Jun 4, 2026, 11:17 PM
Modified
Jul 23, 2026, 6:10 AM

View source JSON

Severity
Moderate
Public date
Jun 2, 2026, 12:00 AM

View source Bugzilla JSON

Updated
Jun 7, 2026, 2:30 PM

JSON