What is the CVSS score of CVE-2026-11633?

CVE-2026-11633 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11633?

A critical remote code execution vulnerability in Google Chrome on macOS (CVE-2026-11633) enables attackers operating a malicious Bluetooth device to execute arbitrary code with minimal user…. A patch is available.

How to fix or mitigate CVE-2026-11633?

Within 24 hours: Audit all macOS systems running Chrome and confirm MDM/auto-update coverage status; create deployment plan for Chrome 149.0.7827.103 and later. Within 7 days: Deploy patched Chrome version (149.0.7827.103+) to all macOS endpoints through MDM or managed update channels; disable Bluetooth on systems unable to patch immediately. Within 30 days: Verify patch compliance through endpoint inventory; implement monitoring for failed auto-updates; document remediation closure.

Google Chrome CVE-2026-11633

EUVD-2026-35233 HIGH

Use After Free (CWE-416)

2026-06-09 chrome-cve-admin@google.com

GHSA-q8r9-522f-rhg7

Google Memory Corruption RCE Use After Free Denial Of Service

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 02:55 vuln.today

CVSS changed

Jun 09, 2026 - 01:22 NVD

8.8 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code via a malicious peripheral. (Chromium security severity: Critical)

AnalysisAI

Remote code execution in Google Chrome on macOS prior to 149.0.7827.103 stems from a use-after-free condition in the browser's Bluetooth subsystem, rated Critical by Chromium's internal severity scale and CVSS 8.8 by NVD. A remote attacker operating a malicious Bluetooth peripheral can trigger memory corruption to execute arbitrary code in the browser process after the victim performs minimal interaction. No public exploit identified at time of analysis, though Google has released a patched Stable channel build addressing the flaw.

Technical ContextAI

The vulnerability is a CWE-416 Use-After-Free defect in Chrome's Web Bluetooth implementation on macOS, which mediates communication between web origins and physical Bluetooth Low Energy peripherals through the navigator.bluetooth API. Use-after-free flaws occur when memory is referenced after being freed, allowing an attacker who controls allocation patterns to coerce the freed slot into holding attacker-controlled data, then dereference it to redirect execution. The Bluetooth stack is a known historical source of high-severity Chrome bugs because it processes asynchronous, externally controlled peripheral data within the privileged browser process, and macOS-specific code paths (CoreBluetooth bridging) add platform-specific lifetime complexity that has produced repeated UAF issues across Chromium releases.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.103 for macOS - upgrade immediately via the Chrome Stable channel by relaunching the browser or pushing the update through MDM/enterprise management (see https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html). For environments that cannot patch immediately, disable Web Bluetooth via the enterprise policy DefaultWebBluetoothGuardSetting=2 (block) or scope it with WebBluetoothAllowedForUrls, which prevents pages from invoking the chooser at the cost of breaking legitimate Web Bluetooth applications such as some hardware-key enrollment flows and IoT device configuration sites. As a defense-in-depth measure, advise users not to approve Bluetooth pairing prompts from untrusted pages and consider temporarily disabling system Bluetooth on Macs that do not require it until the update is deployed.