What is the CVSS score of CVE-2026-11164?

CVE-2026-11164 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11164?

Google Chrome prior to version 149.0.7827.53 contains a use-after-free memory vulnerability in the Blink rendering engine that permits remote code execution when users visit attacker-controlled…. A patch is available.

How to fix or mitigate CVE-2026-11164?

Within 24 hours: Identify all Chrome instances and current versions across the organization; communicate vulnerability urgency to IT and end users. Within 7 days: Deploy Google Chrome version 149.0.7827.53 or later via centralized management systems; verify patch deployment completion across all endpoints and audit for remaining vulnerable instances. Within 30 days: Review security logs and endpoint telemetry for suspicious activity during the pre-patch window; implement policies enforcing automatic Google Chrome updates.

Google Chrome CVE-2026-11164

EUVD-2026-34625 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-mgfv-w78p-gx46

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 03:11 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Blink in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome's Blink rendering engine prior to version 149.0.7827.53 allows a remote attacker to execute arbitrary code within the renderer sandbox by luring a user to a crafted HTML page. The flaw is a use-after-free memory corruption issue (CWE-416) tagged for RCE and DoS impact, and no public exploit has been identified at time of analysis. CISA SSVC currently lists exploitation as 'none' despite the high CVSS 8.8 score, indicating significant theoretical impact but no observed in-the-wild activity yet.

Technical ContextAI

Blink is the open-source browser engine used by Chrome and other Chromium-derived browsers to parse HTML/CSS and execute layout, DOM, and rendering logic. CWE-416 (Use After Free) occurs when a program continues to use a pointer to memory after it has been freed, allowing an attacker who can influence subsequent heap allocations to place attacker-controlled data where freed objects previously lived, enabling arbitrary code execution when the dangling pointer is dereferenced. Because Blink processes untrusted web content in the renderer process, a successful UAF exploit yields code execution constrained to Chrome's renderer sandbox (CVSS scope: Unchanged), and a separate sandbox-escape chain would typically be required to fully compromise the host.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - upgrade Chrome to this version or later via the Stable channel update documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html, and force a relaunch so the new binaries take effect (Chrome holds the prior version in memory until restart). For managed fleets, push the update via Group Policy / Chrome Browser Cloud Management and verify version compliance through chrome://version reporting. Until patching is complete, compensating controls include enabling Site Isolation (already default but verify via chrome://flags), enforcing Enhanced Safe Browsing to block known malicious pages (trade-off: sends URL telemetry to Google), and restricting browsing to allowlisted business sites via web proxy policy (trade-off: high operational friction); also audit and update Chromium-based applications (Edge, Electron apps) once their respective vendors ship a rebased build.