What is the CVSS score of CVE-2026-11641?

CVE-2026-11641 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11641?

Google Chrome on Windows users are vulnerable to remote code execution (CVE-2026-11641) through malicious websites, with potential to compromise employee systems and organizational data.. A patch is available.

How to fix or mitigate CVE-2026-11641?

Within 24 hours: Alert all Chrome users to the vulnerability and initiate emergency patch deployment planning. Within 7 days: Deploy Google Chrome 149.0.7827.103 or later to all Windows systems via patch management. Within 30 days: Validate 100% patch deployment, audit systems for exploitation evidence, and enforce mandatory auto-update policies.

Google Chrome CVE-2026-11641

EUVD-2026-35241 HIGH

Use After Free (CWE-416)

2026-06-09 chrome-cve-admin@google.com

GHSA-v7j2-vv57-hgqm

Google Memory Corruption RCE Use After Free Microsoft Denial Of Service

7.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 02:52 vuln.today

CVSS changed

Jun 09, 2026 - 01:22 NVD

7.5 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 7.5

DescriptionCVE.org

Use after free in Bluetooth in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Remote code execution in Google Chrome on Windows prior to 149.0.7827.103 can be triggered via a use-after-free flaw in the Bluetooth component, allowing a remote attacker to execute arbitrary code when a victim visits a crafted HTML page and performs specific UI gestures. Chromium rates the severity as Critical, though the CVSS 3.1 score of 7.5 reflects high attack complexity and required user interaction. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.

Technical ContextAI

The flaw resides in Chrome's Web Bluetooth implementation, which exposes the Bluetooth GATT API to web pages so they can discover and communicate with nearby BLE devices. CWE-416 (Use After Free) indicates that an object in the Bluetooth subsystem is freed while a reference to it remains in use, allowing an attacker to manipulate the dangling pointer and corrupt memory. Successful exploitation typically leads to controlled heap corruption inside the renderer or browser process, which on Chromium-based browsers is a well-known stepping stone toward arbitrary code execution when combined with appropriate heap grooming. The defect is Windows-specific per the description, suggesting either a platform-specific code path in the Windows Bluetooth backend or a bug exposed only by Windows BLE stack behavior.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.103 for Windows - upgrade to this Stable channel build or later, as announced at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html. Managed environments should force-update via Chrome's Group Policy (RelaunchNotification and TargetVersionPrefix) or enterprise deployment tooling rather than waiting for background updates. Users of downstream Chromium browsers on Windows should monitor their vendor's advisories and apply the equivalent rebase. As an interim compensating control until patching is complete, disable Web Bluetooth by setting the DefaultWebBluetoothGuardSetting policy to 2 (block), which prevents sites from requesting Bluetooth access at the cost of breaking legitimate Web Bluetooth applications (a small population in most enterprises). Restricting browsing to trusted sites via SitePerProcess and SafeBrowsing enhanced protection further reduces the chance a victim reaches a malicious crafted page.