CVE-2026-11676
High · 8.3CVSS
8.3
EPSS
0.2%
Published
Jun 9, 2026
CISA due date
—
The record
Insufficient validation of untrusted input in Dawn in Google Chrome on Linux and ChromeOS prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | chromium | 0 | 149.0.7827.102-bp160.1.1 |
| openSUSE:Tumbleweed | chromium | 0 | 149.0.7827.102-1.1 |
Related vulnerabilities
- CVE-2026-12466 Heap buffer overflow in WebRTC in Google Chrome on Windows prior to 149.0.7827.155… Also affects chromium
- CVE-2026-12458 Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.155… Also affects chromium
- CVE-2026-12441 Use after free in File Input in Google Chrome on Linux prior to 149.0.7827.155 allowed a… Also affects chromium
- CVE-2026-12035 Use after free in Views in Google Chrome on Windows prior to 149.0.7827.115 allowed a… Also affects chromium
- CVE-2026-12028 Use after free in GPU in Google Chrome on Android prior to 149.0.7827.115 allowed a… Also affects chromium
- CVE-2026-12029 Use after free in Video in Google Chrome on Windows prior to 149.0.7827.115 allowed a… Also affects chromium
- CVE-2026-12034 Insufficient validation of untrusted input in Linux Toolkit Theming in Google Chrome on… Also affects chromium
- CVE-2026-12030 Out of bounds write in GPU in Google Chrome on Android prior to 149.0.7827.115 allowed a… Also affects chromium