CVE-2026-11173

HighCVSS 8.8/10Last modified Jul 23, 2026

Description

Out of bounds write in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
Google	Chrome	>= 149.0.7827.53, < 149.0.7827.53

References

https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.htmlVendor Advisory
https://issues.chromium.org/issues/502337304Permissions Required

Timeline

Published: Jun 4, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1117307.2P-Net before 1.0.3 does not validate the LengthPeerStationName field of a CheckPeers block in get_check_peer(). The received length (up to 2 CVE-2026-1117318.7P-Net before 1.0.3 enters an infinite loop when handling a read request for the PDPortDataCheck record with subslot 0 (whole module). The lo CVE-2026-1117329.3P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data length from a field of the ARVendorBlock request tha CVE-2026-1117338.7P-Net before 1.0.3 dereferences a NULL AR pointer when handling an implicit read request without a valid target AR UUID for a record index t CVE-2026-1117347.1P-Net before 1.0.3 does not validate the length of a received Ethernet frame in pf_eth_recv() before reading the EtherType, any VLAN tags an CVE-2026-1117357.1P-Net before 1.0.3 contains an integer underflow in pf_cpm_c_data_ind(). When handling a received cyclic data frame while the consumer is in CVE-2026-1117368.7P-Net before 1.0.3 dereferences a NULL AR pointer in pf_fspm_cm_read_ind() when handling an implicit read request without a valid target AR CVE-2026-1117373.5The Speed Optimizer WordPress plugin before 7.8.5 does not sanitise or escape some of its settings before outputting them in the head of fr CVE-2026-1117385.5The Speed Optimizer WordPress plugin before 7.8.5 does not verify network-level privilege before applying an option change to the whole mul CVE-2026-1117397.5The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS) WordPress plugin before 5.5.0 do not bind the acco CVE-2026-111745.3Inappropriate implementation in Site Isolation in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the ren CVE-2026-1117402.7The Post Duplicator WordPress plugin before 3.0.17 does not check whether the requesting user may view each post before returning a list of