CVE-2026-11100

CriticalCVSS 9.6

Published: 04/06/2026(UTC)Updated: 23/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

17th percentile - higher than 17% of all known CVEs

Summary

Google Chrome on Mac prior to version 149.0.7827.53 has a use-after-free vulnerability in File Input. A remote attacker, after convincing a user to perform specific UI gestures, can use a crafted HTML page to potentially perform a sandbox escape.

Risk Assessment

An attacker can escape the browser sandbox and gain access to the operating system, enabling arbitrary code execution on the victim's machine.

Recommendation

Update Google Chrome on macOS to version 149.0.7827.53 or later.

Original NVD description (English source)

Use after free in File Input in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)