CVE-2026-11100

chromium-browser: Use after free in File Input

View on CVE.org
Published Jun 4, 2026 CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Description
Use after free in File Input in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

Analysis

AI-generated

Technical impact

The vulnerability is a use‑after‑free flaw in the File Input handling of Google Chrome on macOS, identified as CWE-416, and it also involves resource management issues identified as CWE-825. A remote attacker who convinces a user to perform specific UI gestures on a crafted HTML page can potentially escape the browser sandbox and execute code with the privileges of the logged‑in user. The flaw can be triggered after the browser reclaims memory, leading to execution of arbitrary code; the Chromium security severity is listed as Medium.

Affected Systems

Google Chrome version 149.0.7827.53 and earlier on macOS are affected. All installations of Chrome on macOS not upgraded beyond the specified version are at risk.

Risk and Exploitability

The EPSS score is <1% and the vulnerability is not listed in CISA’s KEV catalog, but the high CVSS score of 9.6 indicates a critical impact. Exploitation requires a crafted HTML page, user interaction, and a victim’s device running a vulnerable Chrome instance on macOS. The attack would allow the attacker to break sandbox confinement, enabling remote code execution with the privileges of the logged‑in user, taking advantage of both CWE‑416 and CWE‑825 weaknesses.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Google Chrome to version 149.0.7827.53 or later on macOS.
  • Enable automatic updates to receive future security patches for Chrome and other Google software.
  • Encourage safe browsing practices and discourage users from interacting with untrusted web content.

Generated by OpenCVE AI on June 7, 2026 at 15:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DSA Debian DSA DSA-6325-1 chromium security update
History
Type Values Removed Values Added
First Time appeared Apple
Apple macos
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Type Values Removed Values Added
Title chromium-browser: Use after free in File Input
Weaknesses CWE-825
References
Metrics threat_severity

None

 threat_severity

Moderate
Type Values Removed Values Added
Title Use‑After‑Free in Chrome File Input Allows Sandbox Escape via Crafted HTML on macOS
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome
Type Values Removed Values Added
Title Use‑After‑Free in Chrome File Input Allows Sandbox Escape via Crafted HTML on macOS
Type Values Removed Values Added
Description Use after free in File Input in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-416
References
Earlier changes (2)
Weaknesses

Sources

Status
PUBLISHED
Assigner
Chrome
Published
Updated
Jun 6, 2026, 2:47 AM
Reserved
Jun 4, 2026, 5:06 PM

View source JSON

Updated
Jun 6, 2026, 2:47 AM

JSON

Status
Analyzed
Published
Jun 4, 2026, 11:17 PM
Modified
Jul 23, 2026, 7:10 AM

View source JSON

Severity
Moderate
Public date
Jun 2, 2026, 12:00 AM

View source Bugzilla JSON

Updated
Jun 7, 2026, 3:15 PM

JSON