Description
Type Confusion in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-06-04
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a type confusion bug in the CSS parser that allows a remote attacker to execute arbitrary code inside a sandbox by delivering a specially crafted HTML page. Labeled as CWE-843, the flaw can compromise the sandboxed execution environment, potentially leading to privilege escalation or unintended manipulation of the browser state.

Affected Systems

Google Chrome versions earlier than 149.0.7827.53 on all supported platforms remain susceptible to this flaw.

Risk and Exploitability

Attackers can exploit this flaw remotely by hosting a malicious page that targets vulnerable Chrome installations. The CVSS score is 8.8; an EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Chromium itself rates the severity as Medium, and users who upgrade beyond the stated version are immune.

Generated by OpenCVE AI on June 5, 2026 at 04:17 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Google Chrome to version 149.0.7827.53 or later and ensure all future updates are automatically installed.
  • Verify that the browser update mechanism is enabled and functioning on all user systems.
  • In managed environments, enforce a policy that blocks installation of any Chrome version older than 149.0.7827.53.
  • Continuously monitor Chrome’s release notes for any additional security patches related to this issue.

Generated by OpenCVE AI on June 5, 2026 at 04:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6325-1 chromium security update
History

Sun, 07 Jun 2026 12:15:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via CSS Type Confusion in Google Chrome chromium-browser: Type Confusion in CSS
References
Metrics threat_severity

None

 threat_severity

Moderate

Sat, 06 Jun 2026 01:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows

Fri, 05 Jun 2026 06:30:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Fri, 05 Jun 2026 03:00:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via CSS Type Confusion in Google Chrome

Fri, 05 Jun 2026 01:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 04 Jun 2026 23:15:00 +0000

Type Values Removed Values Added
Description Type Confusion in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-843
References

Subscriptions

Apple Macos
Google Chrome
Linux Linux Kernel
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-06-06T03:56:30.490Z

Reserved: 2026-06-04T17:06:44.454Z

Link: CVE-2026-11076

cve-icon Vulnrichment

Updated: 2026-06-05T00:40:31.630Z

cve-icon NVD

Status : Analyzed

Published: 2026-06-04T23:17:12.307

Modified: 2026-06-06T01:39:41.170

Link: CVE-2026-11076

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-06-02T00:00:00Z

Links: CVE-2026-11076 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-06-05T06:15:33Z

Weaknesses
  • CWE-843

    Access of Resource Using Incompatible Type ('Type Confusion')