PatchSiren cyber security CVE debrief
CVE-2026-11085 Google CVE debrief
CVE-2026-11085 is an integer overflow vulnerability in the GPU of Google Chrome on Android versions prior to 149.0.7827.53. This vulnerability, with a CVSS score of 8.8, could allow a remote attacker to potentially perform out-of-bounds memory access via a crafted HTML page. The vulnerability is considered to have a High severity rating by the CVSS scoring system.
- Vendor
- Product
- Chrome
- CVSS
- HIGH 8.8
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-04
- Original CVE updated
- 2026-06-08
- Advisory published
- 2026-06-04
- Advisory updated
- 2026-06-08
Who should care
Users of Google Chrome on Android, particularly those using versions prior to 149.0.7827.53, should be aware of this vulnerability and take steps to mitigate it.
Technical summary
The vulnerability is caused by an integer overflow in the GPU of Google Chrome on Android. This could allow a remote attacker to potentially perform out-of-bounds memory access via a crafted HTML page.
Defensive priority
High
Recommended defensive actions
- Update Google Chrome to version 149.0.7827.53 or later.
- Use a web browser other than Google Chrome until an update is available.
Evidence notes
The CVE-2026-11085 vulnerability was published on June 4, 2026, and modified on June 8, 2026. The vulnerability affects Google Chrome on Android versions prior to 149.0.7827.53.
Official resources
-
CVE-2026-11085 CVE record
CVE.org
-
CVE-2026-11085 NVD detail
NVD
-
Source item URL
nvd_modified
-
Mitigation or vendor reference
[email protected] - Vendor Advisory
-
Source reference
[email protected] - Permissions Required
CVE-2026-11085 was published on [cvePublishedAt] and modified on [cveModifiedAt].