CVE Catalog
CVE-2026-11095
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk0.28%
20th percentile - higher than 20% of all known CVEs
Summary
Insufficient input validation in Codecs in Google Chrome prior to 149.0.7827.53 allows a remote attacker who compromised the renderer to potentially escape the sandbox via a crafted HTML page.
Risk Assessment
Sandbox escape could allow the attacker to execute code outside browser restrictions, posing a serious system threat.
Recommendation
Update Google Chrome to version 149.0.7827.53 or later.
Original NVD description (English source)
Insufficient validation of untrusted input in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)