Quick answers
- Is CVE-2026-11669 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-11669 being exploited in the wild.
- How severe is CVE-2026-11669?
- Informational severity, with a CVSS score of 0, published 9 June 2026.
- Which products and versions are affected?
- Google ChromeOS prior to 149.0.7827.103.
- Is there a fix for CVE-2026-11669?
- A patch was published on 2026-06-08: Fixed in Stable Channel Update 149.0.7827.103 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-11669 attacked?
- It is attacked over the network, in an operating system.
- Am I affected by CVE-2026-11669?
- Check whether you run Google ChromeOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This vulnerability is classified as an out-of-bounds read (and potentially an integer overflow) within the Media component of Google Chrome on ChromeOS. The flaw is reachable by a remote attacker who has already achieved a compromise of the renderer process. By enticing a user to visit a specially crafted HTML page, the attacker can exploit this memory safety issue to read sensitive information from the process memory. The issue was addressed in ChromeOS version 149.0.7827.103. The vulnerability is tracked as CWE-472 (External Control of Assumed-Immutable Web Parameter) in some contexts, though the primary impact is memory disclosure.
Affected products
- Google ChromeOS prior to 149.0.7827.103
Timeline
- 2026-05-21: disclosed: Reported to Chromium project
- 2026-06-08: patched: Fixed in Stable Channel Update 149.0.7827.103
- 2026-06-09: advisory: NVD publication date