CVE-2026-11296

HighCVSS 7.5/10Last modified Jul 23, 2026

Description

Inappropriate implementation in ImageCapture in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low)

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

VendorProductVersions
GoogleChrome>= 149.0.7827.53, < 149.0.7827.53

References

Timeline

Published
Jun 5, 2026
Last modified
Jul 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1129655.5Out-of-bounds read in Windows Management Instrumentation allows an authorized attacker to disclose information locally.CVE-2026-1129667.5Uncontrolled resource consumption in Windows Security Account Manager allows an unauthorized attacker to deny service over a network.CVE-2026-1129679.8Heap-based buffer overflow in Windows Xbox Live Networking Service allows an unauthorized attacker to execute code over a network.CVE-2026-1129687.0Use after free in Windows COM allows an authorized attacker to elevate privileges locally.CVE-2026-1129696.6Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges with a physical attack.CVE-2026-112977.7Insufficient validation of untrusted input in Reader Mode in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to bypCVE-2026-1129707.0Use after free in Windows SMB Client allows an authorized attacker to elevate privileges locally.CVE-2026-1129717.0Heap-based buffer overflow in Windows SMB Client allows an authorized attacker to elevate privileges locally.CVE-2026-1129727.5Integer overflow or wraparound in Windows SMB Server allows an authorized attacker to execute code over a network.CVE-2026-1129737.1Improper access control in Windows Kernel allows an authorized attacker to bypass a security feature locally.CVE-2026-1129745.5Improper access control in Microsoft Account allows an authorized attacker to perform tampering locally.CVE-2026-1129755.3Untrusted pointer dereference in Windows Link-Layer Discovery Protocol (LLDP) allows an unauthorized attacker to deny service over an adjace
CVE-2026-11296: High severity, CVSS 7.5 | Vulnix