What is the CVSS score of CVE-2026-11117?

CVE-2026-11117 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11117?

Google Chrome on Windows contains a remote code execution vulnerability (CVE-2026-11117, CVSS 8.8) that allows attackers to execute arbitrary code on affected systems through maliciously crafted…. A patch is available.

How to fix or mitigate CVE-2026-11117?

Within 24 hours: Inventory Chrome deployments on Windows systems and communicate patch urgency to stakeholders. Within 7 days: Deploy Chrome version 149.0.7827.53 or later across all Windows endpoints using your standard patch distribution mechanism. Within 30 days: Verify 100% patch deployment completion and implement browser policy controls to prevent installation of vulnerable Chrome versions.

Google Chrome CVE-2026-11117

EUVD-2026-34578 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-6xwq-7mfm-26p5

RCE Denial Of Service Google Use After Free Memory Corruption Microsoft

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 03:08 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Views in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome on Windows prior to 149.0.7827.53 allows a remote attacker to exploit a use-after-free condition in the Views component via a crafted HTML page. The flaw carries a CVSS 3.1 score of 8.8 with network attack vector and requires user interaction (visiting a malicious page), and no public exploit has been identified at time of analysis despite Google's vendor patch being released.

Technical ContextAI

The vulnerability resides in Chrome's Views framework, the cross-platform UI toolkit used by Chromium to render browser chrome elements such as menus, dialogs, and window decorations on Windows. CWE-416 (Use-After-Free) indicates that memory is referenced after it has been freed, typically because an object's lifetime is not properly synchronized with operations that reference it; attackers can groom the heap to place attacker-controlled data at the freed location, leading to controlled memory corruption and code execution within the renderer or browser process. Google's chrome-cve-admin team reported this via the Chromium issue tracker (issues.chromium.org/issues/501403820), and Chromium itself rated the security severity as Medium despite NVD's CVSS of 8.8.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 for Windows - upgrade immediately via Chrome's built-in updater (chrome://settings/help) or by redeploying the latest MSI for managed environments. Enterprise administrators using Chrome Browser Cloud Management or Group Policy should verify the rollout target version and force-restart Chrome processes since the fix only takes effect after a browser relaunch; details are in the Chrome Releases blog at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. As a temporary compensating control where patching is delayed, restrict browsing to trusted sites via SmartScreen/URL filtering or use an alternate browser for untrusted content - note this materially impacts user productivity and is only a short-term measure. Chromium-based derivatives (Edge, Brave, Opera, Vivaldi) likely require their own vendor-supplied updates that incorporate the same upstream fix.