What is the CVSS score of CVE-2026-11177?

CVE-2026-11177 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-11177?

Google Chrome versions prior to 149.0.7827.53 contain a vulnerability allowing remote attackers to execute arbitrary code through specially crafted web pages.. A patch is available.

How to fix or mitigate CVE-2026-11177?

Within 24 hours: Alert stakeholders and verify patch availability through Google's Chrome update channels. Within 7 days: Deploy Chrome version 149.0.7827.53 or later across all managed endpoints using your standard software distribution process. Within 30 days: Validate deployment completion and confirm all Chrome instances are running version 149.0.7827.53 or later through endpoint audits.

Google Chrome CVE-2026-11177

EUVD-2026-34638 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-948c-2225-9ppr

Denial Of Service Use After Free Memory Corruption Google Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 18:31 vuln.today

CVSS changed

Jun 05, 2026 - 18:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Omnibox in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Heap corruption in Google Chrome's Omnibox component prior to version 149.0.7827.53 allows remote attackers to potentially execute arbitrary code via a use-after-free condition triggered by a crafted HTML page combined with specific user interface gestures. The flaw carries a CVSS 8.8 (High) rating, though Chromium's internal triage assigned only Medium severity, and EPSS estimates exploitation probability at just 0.03%. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

The Omnibox is Chrome's combined address and search bar, a complex UI surface that handles URL parsing, search suggestion rendering, autocomplete, and navigation dispatch. CWE-416 (Use After Free) means the code accesses heap memory after it has been freed, typically because an object's lifetime is not correctly synchronized with the asynchronous events (network suggestions, user keystrokes, UI focus changes) that drive Omnibox state. When attacker-controlled HTML content (such as page-driven navigation, fragment changes, or window.open calls) interacts with Omnibox state at the wrong moment, the dangling pointer can be reused to corrupt heap structures, potentially enabling code execution within Chrome's renderer or browser process depending on which Omnibox subsystem holds the freed object.

RemediationAI

Vendor-released patch: update Chrome desktop to 149.0.7827.53 or later via the Stable channel update documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html, then restart the browser to activate the new binary (Chrome does not load patched code until restart, so verify via chrome://version after relaunch). Users of Chromium derivatives should apply the corresponding vendor update once published. As a temporary compensating control for unpatched endpoints, restrict browsing to trusted sites via enterprise URL allowlisting (chrome://policy URLBlocklist / URLAllowlist) since exploitation requires the user to load attacker-controlled HTML and perform a UI gesture; the trade-off is significant productivity impact and incomplete coverage, so this is only viable for short windows on high-risk users.