What is the CVSS score of CVE-2026-11637?

CVE-2026-11637 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11637?

Google Chrome on macOS versions prior to 149.0.7827.103 contain a critical remote code execution vulnerability (CVE-2026-11637) that allows attackers to compromise employee devices through malicious…. A patch is available.

How to fix or mitigate CVE-2026-11637?

Within 24 hours: Issue mandatory security alert directing all macOS Chrome users to update to version 149.0.7827.103 or later; enable automatic Chrome updates organization-wide if not already configured. Within 7 days: Use Mobile Device Management (MDM) or endpoint management tools to verify 95%+ of systems are patched; identify and escalate non-compliant devices. Within 30 days: Achieve 100% patch compliance; review security logs for exploitation indicators associated with vulnerability discovery period.

Google Chrome CVE-2026-11637

EUVD-2026-35237 HIGH

Use After Free (CWE-416)

2026-06-09 chrome-cve-admin@google.com

GHSA-7x6f-897q-8h7j

Google Memory Corruption RCE Use After Free Denial Of Service

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 02:53 vuln.today

CVSS changed

Jun 09, 2026 - 01:22 NVD

8.8 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Views in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Remote code execution in Google Chrome on macOS prior to version 149.0.7827.103 stems from a use-after-free flaw in the Views UI component, enabling a remote attacker to run arbitrary code when a victim visits a crafted HTML page. Google rates the underlying Chromium severity as Critical, and a vendor patch is available; no public exploit identified at time of analysis. The CVSS 8.8 score reflects network-reachable exploitation with low complexity but requiring user interaction (visiting the malicious page).

Technical ContextAI

The vulnerability resides in Chrome's Views framework, the cross-platform C++ UI toolkit Chromium uses to build browser windows, menus, dialogs, and other widget hierarchies on desktop platforms. CWE-416 (Use After Free) indicates that an object in the Views subsystem is dereferenced after its memory has been freed, typically because lifetime management between event handlers, animations, or focus tracking is mishandled. An attacker who can influence the sequence of UI events from a rendered page can groom the freed allocation and pivot the dangling pointer into arbitrary code execution within the affected process. The bug is scoped to the macOS build of Chrome per the description, suggesting the regression lies in platform-specific Views integration with AppKit.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.103 for macOS - upgrade immediately via the built-in updater (chrome://settings/help) or by redeploying the latest stable MSI/PKG through your management tooling, then force-restart browser processes so the new binary loads. The fix is documented in the Chrome Releases stable channel update at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html. Until the patch is deployed, compensating controls include enforcing Site Isolation (already default in Chrome) to keep renderer compromises contained, blocking untrusted browsing through enterprise web-filtering or a secure web gateway (trade-off: breaks ad-hoc browsing), and restricting Chrome on macOS endpoints via MDM until the update is applied (trade-off: user-productivity impact). Downstream Chromium browsers should be tracked for their corresponding rebases - do not assume Edge, Brave, or Opera are patched until each vendor publishes a corresponding release note.