CVE-2026-11662

HighCVSS 8.8/10Last modified Jul 23, 2026

Description

Type Confusion in Bindings in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-843

Affected software

Vendor	Product	Versions
Google	Chrome	>= 149.0.7827.103, < 149.0.7827.103

References

https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.htmlRelease Notes, Vendor Advisory
https://issues.chromium.org/issues/513773313Permissions Required

Timeline

Published: Jun 9, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1166207.3A security vulnerability has been detected in Tencent RapidJSON up to 1.1.0. This issue affects the function GenericStringStream<UTF8<char>>CVE-2026-1166216.4The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v CVE-2026-1166227.2The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'service_time' para CVE-2026-1166237.3A vulnerability was detected in code-projects Simple Content Management System 1.0. Impacted is an unknown function of the file /web/admin/w CVE-2026-1166248.8The Advanced Members for ACF plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.3.0 via the CVE-2026-1166278.7Improper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Devolutions PowerShell CVE-2026-116638.3Use after free in Skia in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potent CVE-2026-1166305.9undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when an Agent composes the redirect and sha CVE-2026-1166315.4A malicious web page could open a tel link in a window that was showing a different website, causing the phone-call prompt to appear as if t CVE-2026-1166325.4A malicious web page could insert arbitrary text into the FaceTime call prompt shown by iOS, potentialy allowing it to display a phishing me CVE-2026-1166337.1A potential vulnerability was reported in some Lenovo Tablets that could allow a third-party application to perform an arbitrary file write CVE-2026-1166345.9OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to issue sync tokens vi