Vulnerability Report

CVE-2026-11112

Title: Insufficient validation in Chromoting

Input Validation Error

Proof Of Concept

PoC Available for CVE-2026-11112

CWE Category CWE-20

Published Date Jun 04, 2026

Modified Date Jul 23, 2026

Exploit Status Available

Score 9.6 CVSS v

Exploit Probability (EPSS)

0.22%

Vulnerability Summary

CVE-2026-11112: Insufficient validation of untrusted input in Chromoting in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted Chrome Extension. (Chromium security severity: Medium)

Impacted Vendors

techland 1

google 1

Reference Links

https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html https://issues.chromium.org/issues/500541413

CVSS v3.1

Source Entity 134c704f-9b21-4f2e-91b3-4a467353bcc0

Severity CRITICAL

9.6

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

REQUIRED

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

CHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Associated Attack Patterns (CAPEC)

Total: Patterns