What is the CVSS score of CVE-2026-11646?

CVE-2026-11646 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11646?

Google Chrome versions prior to 149.0.7827.103 contain a remote code execution vulnerability in the ViewTransitions component that allows attackers to execute arbitrary code within the browser…. A patch is available.

How to fix or mitigate CVE-2026-11646?

Within 24 hours: Audit Chrome deployment across all endpoints and identify versions prior to 149.0.7827.103; notify users and IT teams of patch urgency. Within 7 days: Deploy Chrome 149.0.7827.103 or later to all endpoints via patch management or auto-update mechanisms; prioritize user-facing workstations. Within 30 days: Verify complete remediation through scanning; confirm no vulnerable instances remain in production.

Google Chrome CVE-2026-11646

EUVD-2026-35246 HIGH

Use After Free (CWE-416)

2026-06-09 chrome-cve-admin@google.com

GHSA-6vj2-2gv4-3q34

Google Memory Corruption RCE Use After Free Denial Of Service

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 02:49 vuln.today

CVSS changed

Jun 09, 2026 - 01:22 NVD

8.8 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in ViewTransitions in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome versions prior to 149.0.7827.103 stems from a use-after-free condition in the ViewTransitions component, allowing a remote attacker to execute arbitrary code within the browser's renderer sandbox by serving a crafted HTML page. Google rates the Chromium security severity as High and a vendor patch is available, though no public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV.

Technical ContextAI

ViewTransitions is a relatively new Chromium web platform API (exposed as the document.startViewTransition() JavaScript interface) that animates DOM state changes between same-document or cross-document navigations by capturing snapshots of old and new views and compositing them. The root cause is CWE-416 (Use After Free): an object referenced during the transition lifecycle is freed while still reachable, so subsequent dereference operates on attacker-controllable reclaimed memory, a classic primitive for type confusion and arbitrary read/write in C++ renderer code. Affected component is Google Chrome (Chromium-based) desktop builds prior to 149.0.7827.103, and because ViewTransitions runs in the renderer process, exploitation yields code execution constrained by Chrome's site-isolated sandbox rather than direct host compromise.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.103 (Stable channel); upgrade all desktop installations to this version or later by triggering Help > About Google Chrome and relaunching, or by pushing the update through your endpoint management system, per https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html. Track downstream Chromium-based browsers (Edge, Brave, Opera, Vivaldi) and apply their corresponding rebased builds as they ship. Until every endpoint is patched, compensating controls include disabling the ViewTransitions feature via the chrome://flags/#view-transition-on-navigation toggle or the corresponding enterprise policy where available (side effect: breaks site-initiated transition animations on modern web apps), enforcing Site Isolation and 'Strict Site Isolation' enterprise policy to limit cross-origin reach of any renderer compromise, and restricting outbound web browsing through a filtering proxy to block unknown attacker-hosted pages (side effect: user friction and possible false positives on legitimate sites). The Chromium tracker entry at https://issues.chromium.org/issues/517168239 will remain access-restricted until the disclosure window expires.