What is the CVSS score of CVE-2026-11042?

CVE-2026-11042 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-11042?

Google Chrome versions before 149.0.7827.53 contain a heap corruption vulnerability (CVE-2026-11042) enabling remote code execution through crafted web pages.. A patch is available.

How to fix or mitigate CVE-2026-11042?

24 hours: Determine Chrome deployment scope across the organization. 7 days: Begin staged rollout of Chrome 149.0.7827.53 or later, starting with non-critical systems. 30 days: Complete deployment to all Chrome instances.

Google Chrome CVE-2026-11042

EUVD-2026-34491 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-cmmh-543x-98cr

Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 16:23 vuln.today

CVSS changed

Jun 05, 2026 - 16:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Views in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Heap corruption in Google Chrome's Views component prior to version 149.0.7827.53 allows a remote attacker to potentially execute code in the renderer when a user is convinced to perform specific UI gestures on a crafted HTML page. The flaw is a use-after-free (CWE-416) carrying a CVSS 8.8 rating, but EPSS is very low at 0.03% (11th percentile) and no public exploit is identified at time of analysis. Google has shipped a patched stable channel build, and Chromium rates the underlying issue as Medium severity.

Technical ContextAI

The defect lives in Chrome's Views UI framework, the C++ layer that renders the browser chrome (menus, dialogs, omnibox, tab strip) and mediates UI events between the user and web content. CWE-416 (Use After Free) means an object in Views is freed while a pointer to it remains reachable; subsequent dereference allows an attacker to influence the contents of the reclaimed heap region and corrupt control or data flow. Because Views runs inside the browser/renderer process and is reached through DOM-triggered UI flows, a crafted HTML page that drives a specific UI gesture (drag, click sequence, focus transition, etc.) can race or re-enter logic that releases an object still in use. The affected CPE family is cpe:2.3:a:google:chrome prior to 149.0.7827.53 on desktop platforms shipped via the Stable channel.

RemediationAI

Vendor-released patch: update Google Chrome to 149.0.7827.53 or later via the Stable channel (Help → About Google Chrome forces an update check and relaunch), as described at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. For managed fleets, push the update via Chrome Browser Cloud Management, Group Policy, or Jamf/Intune and verify version compliance; Chromium-based browsers should be updated to the corresponding rebase once published by their vendors, and Electron applications should bump to a Chromium 149.0.7827.53-aligned runtime. No clean configuration workaround eliminates the bug, but interim compensating controls include enabling Site Isolation (default on), keeping the Enhanced Safe Browsing setting on to block known malicious pages (trade-off: sends more telemetry to Google), and for high-risk users routing browsing through a remote browser isolation service until the patch is deployed (trade-off: latency and broken web features).