Zero Day MonitorZDM
DashboardVulnerabilitiesTrendingZero-DaysNewsAbout
Login
ImpressumPrivacy Policy
Zero Day Monitor © 2026
2341 articles · 161210 vulns · 36/41 feeds (7d)
← Back to list
8.8
CVE-2026-11680EXPLOITEDPATCHED
google · chrome

CVE-2026-11680: Use after free in Media in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker to execute arbitra

Description

Use after free in Media in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Affected Products

VendorProductVersions
googlechrome149.0.7827.103, 149.0.7827.53

Also Affects

Downstream vendors/products affected by this vulnerability

VendorProductSourceConfidence
googlechromecert_advisory90%

References

  • https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html
  • https://issues.chromium.org/issues/517004487

Related News (2 articles)

Tier B
BSI Advisories2h ago
[NEU] [hoch] Google Chrome: Mehrere Schwachstellen
→ No new info (linked only)
Tier C
VulDB6h ago
CVE-2026-11680 | Google Chrome up to 149.0.7827.53 on Windows Media use after free (ID 517004)
→ No new info (linked only)
CVSS 3.18.8 CRITICAL
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA KEV❌ No
Actively exploited✅ Yes
Patch available
149.0.7827.103
CWECWE-416
PublishedJun 8, 2026
Last enriched6h agov2
Trending Score66
Source articles2
Independent2
Info Completeness9/14
Missing: epss, kev, exploit, iocs, mitre_attack

Community Vote

0
Login to vote
0 upvotes0 downvotes
No votes yet

Related CVEs (5)

HIGHCVE-2026-5281EXPKEV
CVE-2026-5281: Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the render
Trending: 151
HIGHCVE-2026-3909EXPKEV
Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
Trending: 114
HIGHCVE-2026-3910EXPKEV
Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Hi
Trending: 114
HIGHCVE-2025-48595EXP
CVE-2025-48595: In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to
Trending: 82
HIGHCVE-2026-11645EXP
CVE-2026-11645: Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitra
Trending: 78

Pin to Dashboard

Verification

State: unverified
Confidence: 0%

Vulnerability Timeline

CVE Published
Jun 8, 2026
Discovered by ZDM
Jun 9, 2026
Actively Exploited
Jun 9, 2026
Patch Available
Jun 9, 2026
Updated: affectedVersions, severity, activelyExploited
Jun 9, 2026

Version History

v2
Last enriched 6h ago
v2Tier C6h ago

Updated severity to CRITICAL, added new affected version 149.0.7827.53, and marked the vulnerability as actively exploited.

affectedVersionsseverityactivelyExploited
via VulDB
v111h ago

Initial creation