CVE-2026-11158: Insufficient validation of untrusted input in Google Chrome
CVE-2026-11158 is a vulnerability in Google Chrome on Mac where insufficient validation of untrusted input in the Downloads component allows a local attacker to potentially escape the sandbox using a crafted AppleScript command. This issue affects versions prior to 149.0.7827.53. The vulnerability has a high severity rating with a CVSS score of 8.6. No known exploits in the wild have been reported. Google has published an advisory for this issue but has not explicitly stated the patch or remediation status in the provided data.
AI Analysis
Technical Summary
This vulnerability involves insufficient validation of untrusted input in the Downloads feature of Google Chrome on Mac systems. A local attacker could leverage this flaw to execute a crafted AppleScript command that may lead to a sandbox escape, compromising the browser's security boundaries. The vulnerability is tracked as CVE-2026-11158 and is assigned a high severity with a CVSS 3.1 score of 8.6, reflecting high impact on confidentiality, integrity, and availability. The affected versions are those before 149.0.7827.53. The vendor advisory URL is provided but does not explicitly confirm patch availability or remediation level.
Potential Impact
Successful exploitation could allow a local attacker to escape the Chrome sandbox on Mac, potentially leading to full system compromise or unauthorized access to sensitive data. The CVSS score of 8.6 indicates a high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution with untrusted downloads and consider limiting local access to trusted users only.
CVE-2026-11158: Insufficient validation of untrusted input in Google Chrome
Description
CVE-2026-11158 is a vulnerability in Google Chrome on Mac where insufficient validation of untrusted input in the Downloads component allows a local attacker to potentially escape the sandbox using a crafted AppleScript command. This issue affects versions prior to 149.0.7827.53. The vulnerability has a high severity rating with a CVSS score of 8.6. No known exploits in the wild have been reported. Google has published an advisory for this issue but has not explicitly stated the patch or remediation status in the provided data.
CVSS v3.1
Score 8.6high
Affected software
pkg:github/chromium/chromiumRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves insufficient validation of untrusted input in the Downloads feature of Google Chrome on Mac systems. A local attacker could leverage this flaw to execute a crafted AppleScript command that may lead to a sandbox escape, compromising the browser's security boundaries. The vulnerability is tracked as CVE-2026-11158 and is assigned a high severity with a CVSS 3.1 score of 8.6, reflecting high impact on confidentiality, integrity, and availability. The affected versions are those before 149.0.7827.53. The vendor advisory URL is provided but does not explicitly confirm patch availability or remediation level.
Potential Impact
Successful exploitation could allow a local attacker to escape the Chrome sandbox on Mac, potentially leading to full system compromise or unauthorized access to sensitive data. The CVSS score of 8.6 indicates a high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution with untrusted downloads and consider limiting local access to trusted users only.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Chrome
- Date Reserved
- 2026-06-04T17:10:33.266Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html","vendor":"Google"}]
Threat ID: 6a220854e29bf47b50dbcb5f
Added to database: 06/04/2026, 23:20:52 UTC
Last enriched: 06/12/2026, 10:32:36 UTC
Last updated: 07/31/2026, 19:22:57 UTC
Views: 43
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.