Remote Code Execution in Google Chrome on Linux

Publication date: 2026-06-04

Last updated on: 2026-06-08

Assigner: Chrome

Description

Inappropriate implementation in Chromoting in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to perform OS-level privilege escalation via malicious network traffic. (Chromium security severity: Medium)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-04

Last Modified

2026-06-08

Generated

2026-07-15

AI Q&A

2026-06-05

EPSS Evaluated

2026-07-14

NVD

CVE-2026-11170

EUVD

EUVD-2026-34631

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 149.0.7827.53 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

Executive Summary

This vulnerability is an inappropriate implementation in the Chromoting component of Google Chrome on Linux systems prior to version 149.0.7827.53. It allows a remote attacker to escalate their privileges at the operating system level by sending malicious network traffic.

Impact Analysis

The vulnerability can allow a remote attacker to gain higher privileges on your Linux system through Google Chrome's Chromoting feature. This means the attacker could potentially execute actions with elevated permissions, leading to unauthorized access or control over your system.

Hi! I’m here to help you understand CVE-2026-11170. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70