PatchSiren cyber security CVE debrief
CVE-2026-11202 Google CVE debrief
A remote attacker can potentially perform a sandbox escape via a crafted HTML page due to inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53.
- Vendor
- Product
- Chrome
- CVSS
- HIGH 8.8
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-04
- Original CVE updated
- 2026-06-06
- Advisory published
- 2026-06-04
- Advisory updated
- 2026-06-06
Who should care
Users of Google Chrome on iOS prior to 149.0.7827.53, as well as administrators and security teams responsible for managing and securing Chrome installations.
Technical summary
The vulnerability, with a CVSS score of 8.8, is caused by inappropriate implementation in Chrome for iOS. It allows a remote attacker to potentially perform a sandbox escape via a crafted HTML page. The Chromium security severity is rated as Medium.
Defensive priority
HIGH
Recommended defensive actions
- Update Google Chrome on iOS to version 149.0.7827.53 or later.
- Ensure that Chrome is configured to automatically update to the latest version.
Evidence notes
The CVE record and NVD detail can be found at [cve-org] and [nvd], respectively.
Official resources
-
CVE-2026-11202 CVE record
CVE.org
-
CVE-2026-11202 NVD detail
NVD
-
Source item URL
nvd_modified
-
Mitigation or vendor reference
[email protected] - Vendor Advisory
-
Source reference
[email protected] - Permissions Required
CVE-2026-11202 was published on [cvePublishedAt] and modified on [cveModifiedAt].