What is the CVSS score of CVE-2026-11644?

CVE-2026-11644 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-11644?

A use-after-free vulnerability in Google Chrome for Linux (CVE-2026-11644) enables arbitrary code execution when users install malicious extensions, affecting organizations with Chrome-based…. A patch is available.

How to fix or mitigate CVE-2026-11644?

24 hours: Notify all users to update Google Chrome to version 149.0.7827.103 or later; verify auto-update is enabled organization-wide. 7 days: Audit and remove suspicious Chrome extensions from user systems; implement extension allowlist policy if not already in place. 30 days: Conduct user training on extension security best practices; review logs for evidence of malicious extension installations prior to patch date.

Google Chrome CVE-2026-11644

EUVD-2026-35244 HIGH

Use After Free (CWE-416)

2026-06-09 chrome-cve-admin@google.com

GHSA-3vrf-5pc8-4996

Google Memory Corruption RCE Use After Free Denial Of Service

7.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

8.0 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 02:50 vuln.today

CVSS changed

Jun 09, 2026 - 01:22 NVD

7.5 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 7.5

DescriptionCVE.org

Use after free in Views in Google Chrome on Linux prior to 149.0.7827.103 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Critical)

AnalysisAI

Use-after-free in the Views component of Google Chrome on Linux prior to 149.0.7827.103 allows remote attackers to execute arbitrary code by tricking a user into installing a crafted malicious extension. Chromium rates the underlying flaw Critical, though the NVD CVSS score of 7.5 reflects the high attack complexity and required user interaction. No public exploit identified at time of analysis.

Technical ContextAI

The defect lives in Chrome's Views UI framework, the C++ toolkit Chromium uses to render and manage windowing/widget hierarchies across platforms. The root cause is CWE-416 (Use After Free): an object in the Views subsystem is freed while another code path retains and later dereferences a dangling pointer. A malicious Chrome Extension can manipulate the lifecycle of Views-managed objects (for example by driving UI state changes through extension APIs) so that the freed memory is reclaimed with attacker-controlled data, yielding control-flow hijack inside the browser process - outside the renderer sandbox. EUVD records the affected component as Chrome on Linux specifically, consistent with platform-specific Views allocator behavior.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.103 for Linux - update all Linux desktops to this stable-channel build or later via the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html, restarting the browser to apply. Until patching is complete, restrict extension installation through enterprise policy ExtensionInstallBlocklist set to '*' combined with an explicit ExtensionInstallAllowlist of vetted IDs (trade-off: blocks user-driven extension adoption and may break workflows that rely on ad-hoc extensions); on managed fleets also enable ExtensionInstallSources to limit origins, and consider ExtensionInstallForcelist for only audited extensions. Communicate to users not to install Chrome extensions from outside the Chrome Web Store and to remove recently installed unknown extensions, since the attack requires user installation of a malicious extension. Track the upstream issue at https://issues.chromium.org/issues/518043597 for further detail once disclosure embargo lifts.