CVE-2026-11124

HighCVSS 8.8/10Last modified Jul 23, 2026

Description

Integer overflow in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122

Affected software

Vendor	Product	Versions
Google	Chrome	>= 149.0.7827.53, < 149.0.7827.53

References

https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.htmlVendor Advisory
https://issues.chromium.org/issues/501511299Permissions Required

Timeline

Published: Jun 4, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-111240The JDBC based JAAS login module accepts a login without a password for accounts whose stored password is NULL. A remote attacker who knows CVE-2026-111241When a non-default stateful session bean passivation strategy is configured, passivated bean state is written to predictably named files in CVE-2026-111242When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state established for a request is no CVE-2026-111243A negative MicroProfile JWT clock skew setting is not rejected and disables validation of the token expiration and other time-based claims. CVE-2026-111244When MicroProfile JWT role-based access control is used, the access constraints of JAX-RS resources are not always enforced as declared: res CVE-2026-111245After a successful WS-Security UsernameToken authentication, the caller identity stays associated with the worker thread once the request co CVE-2026-111246The embedded OpenEJB HTTP server does not isolate HTTP sessions between web applications. A remote attacker can use a session established in CVE-2026-111247When resolving security roles of a realm-authenticated caller, the caller's user name is also treated as a role name in addition to the role CVE-2026-111248The Jakarta Security identity store backed by the Tomcat user database compares the supplied password with the stored value as plain text an CVE-2026-111249The development-time LiveReload support listens on all network interfaces without authentication and accepts websocket connections from any CVE-2026-111258.8Use after free in Compositing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox v CVE-2026-111250The embedded OpenEJB HTTP server reports every request as authenticated when an application requests authentication programmatically. A remo