PatchSiren cyber security CVE debrief
CVE-2026-11074 Google CVE debrief
CVE-2026-11074 is a use-after-free vulnerability in WebRTC in Google Chrome on Linux, prior to version 149.0.7827.53. This vulnerability, with a CVSS score of 8.8, could allow a remote attacker to execute arbitrary code via a crafted HTML page. The vulnerability was published on [cvePublishedAt] and modified on [cveModifiedAt].
- Vendor
- Product
- Chrome
- CVSS
- HIGH 8.8
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-04
- Original CVE updated
- 2026-06-06
- Advisory published
- 2026-06-04
- Advisory updated
- 2026-06-06
Who should care
Users of Google Chrome on Linux, particularly those who may be targeted by remote attackers, should be aware of this vulnerability and take steps to mitigate it.
Technical summary
The vulnerability is a use-after-free issue in WebRTC, which could allow remote code execution. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Defensive priority
High
Recommended defensive actions
- Update Google Chrome to version 149.0.7827.53 or later.
- Use a web browser other than Google Chrome, or use a different operating system.
Evidence notes
Evidence from the NVD and Chromium security team indicates that this is a high-severity vulnerability.
Official resources
-
CVE-2026-11074 CVE record
CVE.org
-
CVE-2026-11074 NVD detail
NVD
-
Source item URL
nvd_modified
-
Mitigation or vendor reference
[email protected] - Vendor Advisory
-
Source reference
[email protected] - Permissions Required
CVE-2026-11074 was published on 2026-06-04T23:17:12.070Z and modified on 2026-06-06T01:39:28.843Z.