CVE-2026-11674

HighCVSS 8.8/10Last modified Jul 23, 2026

Description

Use after free in Guest View in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
Google	Chrome	>= 149.0.7827.103, < 149.0.7827.103

References

https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.htmlVendor Advisory
https://issues.chromium.org/issues/516910450Permissions Required

Timeline

Published: Jun 9, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1167406.5libcss through 0.9.2 contains a NULL pointer dereference vulnerability in mq_parse_media_query() that allows remote attackers to crash consu CVE-2026-1167416.5Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speex_bits_read_whole_bytes() in libspeex/bits.c that mishan CVE-2026-1167424.4HTSlib through 1.24 contains a heap out-of-bounds write and read vulnerability in bgzf_index_load_hfile() in bgzf.c that allows attackers to CVE-2026-1167435.5libyal libmsiecf through 20260525 contains a double free vulnerability in libmsiecf_url_values_read_data() that allows attackers to corrupt CVE-2026-1167445.3ntop nDPI through 6.0 contains an out-of-bounds read vulnerability in dissect_softether_host_fqdn() in softether.c that compares host_name u CVE-2026-1167456.5QloApps through 1.7.0 contains an information disclosure vulnerability in OrderConfirmationController::init() that allows unauthenticated at CVE-2026-1167465.3QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows CVE-2026-1167478.1Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge session tokens by u CVE-2026-1167488.8Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that exposes the X-Transmissio CVE-2026-1167496.4The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'className' parameter CVE-2026-116753.1Out of bounds read in Skia in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to le CVE-2026-1167506.5The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to blind SQL Injection via the 'catid' parameter in all versi