CVE-2026-11009

CriticalCVSS 9.6

Published: 04/06/2026(UTC)Updated: 22/07/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

25th percentile - higher than 25% of all known CVEs

Summary

Use-after-free vulnerability in the USB component of Google Chrome on Windows prior to 149.0.7827.53. A remote attacker could potentially escape the sandbox via a crafted HTML page.

Risk Assessment

An attacker could gain access to system resources outside the browser sandbox, leading to full compromise of the Windows system.

Recommendation

Update Google Chrome to version 149.0.7827.53 or later.

Original NVD description (English source)

Use after free in USB in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)