CVE-2026-11094

chromium-browser: Use after free in Codecs

View on CVE.org
Published Jun 4, 2026 CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Description
Use after free in Codecs in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

Analysis

AI-generated

Technical impact

The vulnerability is a use‑after‑free in the media codecs component of Google Chrome on Windows. When a renderer process is compromised, a specially crafted HTML page can trigger access to freed memory, potentially allowing the attacker to escape the sandbox and execute arbitrary code within the user’s operating system.

Affected Systems

Any Windows build of Google Chrome before version 149.0.7827.53, including the desktop channel, is affected.

Risk and Exploitability

The EPSS score is < 1%. The vulnerability is not listed in the CISA KEV catalog, which indicates limited known exploitation. Still, because the exploit would enable a sandbox escape, success would give an attacker high privileges and remote code execution. The attack requires the attacker to already compromise the renderer process and deliver a malicious HTML page, so the impact is confined to environments where this control can be achieved. The CVSS score of 9.6 indicates a high severity, and Chromium rated the overall severity as medium.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 149.0.7827.53 or later.
  • Ensure the browser is set to receive automatic updates or apply the latest release manually.
  • Monitor for suspicious renderer activity and restrict untrusted web content or employ site isolation settings to reduce risk.

Generated by OpenCVE AI on June 7, 2026 at 15:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DSA Debian DSA DSA-6325-1 chromium security update
History
Type Values Removed Values Added
First Time appeared Microsoft
Microsoft windows
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft windows
Type Values Removed Values Added
Title chromium-browser: Use after free in Codecs
Weaknesses CWE-825
References
Metrics threat_severity

None

 threat_severity

Moderate
Type Values Removed Values Added
Title Use After Free in Chrome Codecs Enables Potential Sandbox Escape on Windows
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome
Type Values Removed Values Added
Title Use After Free in Chrome Codecs Enables Potential Sandbox Escape on Windows
Type Values Removed Values Added
Description Use after free in Codecs in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-416
References
Earlier changes (2)
Weaknesses

Sources

Status
PUBLISHED
Assigner
Chrome
Published
Updated
Jun 5, 2026, 4:29 PM
Reserved
Jun 4, 2026, 5:06 PM

View source JSON

Updated
Jun 5, 2026, 1:13 PM

JSON

Status
Analyzed
Published
Jun 4, 2026, 11:17 PM
Modified
Jul 23, 2026, 7:10 AM

View source JSON

Severity
Moderate
Public date
Jun 2, 2026, 12:00 AM

View source Bugzilla JSON

Updated
Jun 7, 2026, 3:15 PM

JSON