What is the CVSS score of CVE-2026-11632?

CVE-2026-11632 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11632?

Google Chrome versions before 149.0.7827.103 contain a remote code execution vulnerability in the TabStrip UI component that allows attackers to execute arbitrary code when users visit malicious…. A patch is available.

How to fix or mitigate CVE-2026-11632?

Within 24 hours: Assess Chrome deployment scope across your environment and alert users of available security update. Within 7 days: Distribute and enforce deployment of Google Chrome version 149.0.7827.103 or later across all systems via your patch management process. Within 30 days: Audit system inventory to confirm all Chrome instances have been updated to patched versions; remediate any non-compliant systems.

Google Chrome CVE-2026-11632

EUVD-2026-35232 HIGH

Use After Free (CWE-416)

2026-06-09 chrome-cve-admin@google.com

GHSA-mj29-63w7-jwqf

Google Memory Corruption RCE Use After Free Denial Of Service

7.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 02:55 vuln.today

CVSS changed

Jun 09, 2026 - 01:22 NVD

7.5 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 7.5

DescriptionCVE.org

Use after free in TabStrip in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Remote code execution in Google Chrome versions prior to 149.0.7827.103 stems from a use-after-free flaw in the TabStrip UI component, allowing remote attackers to execute arbitrary code when victims interact with a malicious HTML page via specific UI gestures. Google rates the Chromium severity as Critical, and a vendor-released patch is available; no public exploit has been identified at time of analysis. The high attack complexity (AC:H) and required user interaction (UI:R) constrain mass exploitation despite the severe technical impact.

Technical ContextAI

TabStrip is the Chromium UI component that manages browser tab rendering, lifecycle, and drag/reorder gestures within Chrome's browser process. The CWE-416 use-after-free root cause indicates that a TabStrip-owned object is freed while another code path retains a dangling pointer, likely triggered when a renderer-served HTML page induces a sequence of UI tab manipulations (drag, drop, close, reorder) that race against tab teardown. Because TabStrip runs in the privileged browser process rather than the sandboxed renderer, successful exploitation gives attackers code execution outside the renderer sandbox - a more serious posture than typical V8 or Blink memory bugs.

RemediationAI

Apply the vendor-released patch by upgrading Google Chrome to version 149.0.7827.103 or later on all desktop platforms; the fix is delivered through Chrome's Stable channel auto-update, but enterprise-managed fleets should force the update via Google Update / Chrome Browser Cloud Management and verify version compliance, as documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html. Downstream Chromium-based browsers must be updated separately once their vendors ship a rebase. As a compensating control until patched, restrict browsing to trusted sites via web filtering, enable Site Isolation (default on), and consider deploying Enhanced Safe Browsing - note these reduce but do not eliminate exposure, since the bug is reachable from any attacker-controlled HTML page combined with a user gesture.