PatchSiren cyber security CVE debrief
CVE-2026-11028 Google CVE debrief
CVE-2026-11028 is a use-after-free vulnerability in the Media component of Google Chrome on Linux and ChromeOS prior to 149.0.7827.53. This vulnerability allows a remote attacker who has compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. The CVSS score for this vulnerability is 8.8, indicating a high severity level.
- Vendor
- Product
- Chrome
- CVSS
- HIGH 8.8
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-04
- Original CVE updated
- 2026-06-06
- Advisory published
- 2026-06-04
- Advisory updated
- 2026-06-06
Who should care
Users of Google Chrome on Linux and ChromeOS are affected by this vulnerability. Specifically, versions prior to 149.0.7827.53 are vulnerable.
Technical summary
The vulnerability is caused by a use-after-free error in the Media component of Google Chrome. This type of error occurs when the program attempts to use memory after it has been freed, which can lead to arbitrary code execution.
Defensive priority
High
Recommended defensive actions
- Update Google Chrome to version 149.0.7827.53 or later to mitigate this vulnerability.
- Users should ensure that their browser is up-to-date to prevent exploitation of this vulnerability.
Evidence notes
The CVE-2026-11028 vulnerability was published on [cvePublishedAt] and modified on [cveModifiedAt]. The vulnerability has a CVSS score of 8.8 and is considered high severity.
Official resources
-
CVE-2026-11028 CVE record
CVE.org
-
CVE-2026-11028 NVD detail
NVD
-
Source item URL
nvd_modified
-
Mitigation or vendor reference
[email protected] - Vendor Advisory
-
Source reference
[email protected] - Permissions Required
CVE-2026-11028 was published on 2026-06-04T23:17:06.813Z and modified on 2026-06-06T01:37:08.170Z.