CVE-2026-11112

chromium-browser: Insufficient validation of untrusted input in Chromoting

Published Jun 4, 2026 CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Description

Insufficient validation of untrusted input in Chromoting in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted Chrome Extension. (Chromium security severity: Medium)

Analysis

Technical impact

An insufficiency in validating untrusted input in the Chromoting component of Google Chrome on Linux allows a remote attacker who has already compromised a renderer process to craft a malicious Chrome Extension that can potentially escape the sandbox. The weaknesses, identified as CWE‑20 and CWE‑501, could let an attacker gain code execution privileges beyond the browser sandbox, jeopardizing system confidentiality and integrity.

Affected Systems

Google Chrome on Linux systems running any version prior to 149.0.7827.53 is affected. The issue is limited to the desktop (stable channel) releases of Chrome on Linux platforms.

Risk and Exploitability

The CVSS score is 9.6, indicating a critical severity, while the EPSS score of < 1% suggests a low probability of exploitation. It is not listed in the CISA KEV catalog. Exploitation requires a prior renderer process compromise and the inclusion of a crafted extension, making it a medium difficulty attack with limited surface area. If a renderer is already breached, an attacker could escape the sandbox and execute arbitrary code.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Google

Chrome

affected

Version	Status	Constraints
`149.0.7827.53`	affected	< 149.0.7827.53

Configuration 1 [-]

AND

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Google

Chrome

Version	Status	Scheme	Platform
`[149.0.7827.53,149.0.7827.53)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to Google Chrome version 149.0.7827.53 or later, which contains the definitive fix for the Chromoting input validation flaw.
If an upgrade cannot be performed immediately, disable or uninstall any Chromoting-related Chrome Extensions that have not been explicitly verified as trusted.
Continuously monitor the system for anomalous extension behavior and ensure that renderer processes are properly sandboxed; apply additional hardening such as disabling unneeded features and enforcing strict extension permissions.

Generated by OpenCVE AI on June 7, 2026 at 15:10 UTC.

Tracking

Advisories

Source	ID	Title
Debian DSA	DSA-6325-1	chromium security update

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.216% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html
https://issues.chromium.org/issues/500541413
https://nvd.nist.gov/vuln/detail/CVE-2026-11112
https://www.cve.org/CVERecord?id=CVE-2026-11112

History

Jun 8, 2026 3:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:a:google:chrome:::::::: cpe:2.3:o:linux:linux_kernel:-:::::::*
Vendors & Products		Linux Linux linux Kernel

Jun 7, 2026 12:15 PM Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title		chromium-browser: Insufficient validation of untrusted input in Chromoting
Weaknesses		CWE-501
References		https://nvd.nist.gov/vuln/detail/CVE-2026-11112 https://www.cve.org/CVERecord?id=CVE-2026-11112
Metrics	threat_severity `None`	threat_severity `Moderate`

Jun 6, 2026 6:45 AM Title updated View changes

Type	Values Removed	Values Added
Title	Chromoting Input Validation Leads to Sandbox Escape in Chrome for Linux

Jun 6, 2026 4:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 5, 2026 3:30 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Google Google chrome
Vendors & Products		Google Google chrome

Jun 5, 2026 2:30 AM Title updated View changes

Type	Values Removed	Values Added
Title		Chromoting Input Validation Leads to Sandbox Escape in Chrome for Linux

Jun 4, 2026 11:15 PM Description updated. Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Description		Insufficient validation of untrusted input in Chromoting in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted Chrome Extension. (Chromium security severity: Medium)
Weaknesses		CWE-20
References		https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html https://issues.chromium.org/issues/500541413