What is the CVSS score of CVE-2026-11636?

CVE-2026-11636 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11636?

Google Chrome for Windows contains a code execution vulnerability (CVE-2026-11636) in versions prior to 149.0.7827.103 that activates when users visit malicious websites.. A patch is available.

How to fix or mitigate CVE-2026-11636?

Within 24 hours: Issue security alert to all Windows Chrome users and initiate distribution of Chrome 149.0.7827.103 or later, prioritizing staff in sensitive data or administrative roles. Within 7 days: Deploy patch to 80 percent of Chrome-using Windows systems and document any deferrals. Within 30 days: Complete deployment across the organization, implement update enforcement policies, and verify full version compliance through asset inventory.

Google Chrome CVE-2026-11636

EUVD-2026-35236 HIGH

Use After Free (CWE-416)

2026-06-09 chrome-cve-admin@google.com

GHSA-2qwf-fvgv-5362

Google Memory Corruption Use After Free Microsoft Denial Of Service

7.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 11:23 vuln.today

CVSS changed

Jun 09, 2026 - 11:22 NVD

7.5 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 7.5

DescriptionCVE.org

Use after free in Autofill in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Heap corruption in Google Chrome's Autofill component on Windows versions prior to 149.0.7827.103 allows remote attackers to potentially achieve code execution by luring users to a malicious HTML page and convincing them to perform specific UI interactions. Chromium rates the underlying flaw as Critical severity, though CVSS scores it 7.5 due to required user interaction and high attack complexity. No public exploit identified at time of analysis.

Technical ContextAI

The vulnerability is a use-after-free (CWE-416) in the Autofill component of Google Chrome on Windows. Autofill is the browser subsystem that suggests and fills saved form data (addresses, payment info, credentials) into web page input fields. A use-after-free occurs when memory is freed but a dangling pointer to it is subsequently dereferenced; in a renderer process this can be steered into heap corruption and, with a suitable exploitation primitive, into arbitrary code execution within the renderer sandbox. Chrome's tagged renderer-process model and site isolation constrain immediate impact, but renderer RCE is historically a stepping stone toward sandbox escape chains.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.103 for Windows; update via Chrome's built-in updater (chrome://settings/help) or by deploying the patched MSI through enterprise channels, then restart all browser processes to ensure the fix is loaded. Enterprise administrators should verify managed Chrome installs pick up the new version per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html and confirm extended-stable / LTS channels are also updated. If patching cannot be performed immediately, the most targeted compensating control is disabling Autofill features under chrome://settings/autofill (addresses, payment methods, passwords) via policy (AutofillAddressEnabled, AutofillCreditCardEnabled set to false), which removes the vulnerable code path's typical trigger surface at the cost of user productivity; users of downstream Chromium browsers should monitor their respective vendors for the merged fix.