cve 2026 11640

CVE-2026-11640 is a critical integer overflow vulnerability in Google Chrome's bundled libyuv library, disclosed on June 8, 2026. The flaw, which affects desktop platforms, allows an attacker to escape the browser sandbox after compromising the renderer process via a crafted HTML page. Google addressed the issue in Chrome version 149.0.7827.102/.103. For Windows users, the primary mitigation is to update Chrome and ensure all Chromium-based browsers are patched. The vulnerability highlights the security risks posed by the browser's supply chain of media parsers, graphics libraries, and codec helpers, which are often invisible to end users.