What is the CVSS score of CVE-2026-11185?

CVE-2026-11185 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-11185?

A use-after-free vulnerability in Google Chrome's V8 engine (CVE-2026-11185) allows attackers to execute code within the browser sandbox through malicious Chrome extensions.. A patch is available.

How to fix or mitigate CVE-2026-11185?

Within 24 hours: Issue mandatory update directive for all Chrome users to upgrade to version 149.0.7827.53 or later. Within 7 days: Verify completion of patches across all endpoints via MDM or patch management tools, and review logs for suspicious extension installations. Within 30 days: Deploy Chrome enterprise policies restricting extensions to administrator-approved sources only, and conduct targeted security awareness training on extension-based social engineering.

Google Chrome CVE-2026-11185

EUVD-2026-34646 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-7rgc-2536-h37p

RCE Denial Of Service Google Use After Free Memory Corruption

8.1

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

SUSE

HIGH

qualitative

Red Hat

9.0 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 13:22 vuln.today

CVSS changed

Jun 05, 2026 - 13:22 NVD

8.1 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.1

DescriptionCVE.org

Use after free in V8 in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Medium)

AnalysisAI

Arbitrary code execution within the Chrome renderer sandbox is possible in Google Chrome versions prior to 149.0.7827.53 due to a use-after-free defect in the V8 JavaScript engine. Exploitation requires social engineering a user into installing a malicious Chrome Extension, after which a crafted extension can trigger the memory corruption and run attacker-controlled code inside the sandboxed process. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

V8 is Chromium's high-performance JavaScript and WebAssembly engine, embedded in Chrome's renderer process and used to execute both web page and extension JavaScript. The flaw is classified as CWE-416 (Use After Free), a memory corruption class where freed heap objects are subsequently referenced, allowing an attacker who controls allocator state and can re-occupy the freed slot to corrupt object metadata and gain control of execution. In this case, the entry point is a Chrome Extension's JavaScript execution context, meaning the malicious extension's privileged access to extension APIs and V8 internals is leveraged to manipulate object lifetimes inside V8 and pivot to arbitrary code execution inside the sandbox.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 on the Stable desktop channel - upgrade all Chrome installations to this version or later as the primary remediation, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. For downstream Chromium-based browsers, install the vendor build that incorporates the equivalent V8 fix. Where immediate patching is not possible, the most effective compensating control is to restrict extension installation: in managed environments use the ExtensionInstallBlocklist/ExtensionInstallAllowlist enterprise policies to allow only vetted extensions from the Chrome Web Store, accepting the trade-off that legitimate user-requested extensions will require admin approval. Additionally, audit currently installed extensions and remove unknown or sideloaded ones; note this does not prevent future social-engineering installs without the policy in place.