What is the CVSS score of CVE-2026-11648?

CVE-2026-11648 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11648?

Google Chrome on Windows prior to version 149.0.7827.103 is vulnerable to heap corruption that permits unauthenticated remote code execution through malicious webpages, placing all unpatched Chrome…. A patch is available.

How to fix or mitigate CVE-2026-11648?

Within 24 hours: Identify all Windows systems running Chrome versions prior to 149.0.7827.103 using endpoint detection and response (EDR) or mobile device management (MDM) tools; prioritize systems with sensitive data access. Within 7 days: Deploy Chrome 149.0.7827.103 or later to 100% of affected Windows endpoints through managed update channels (Google Update service, enterprise deployment tools, or MDM); verify successful updates on a statistically representative sample. Within 30 days: Implement mandatory browser auto-update policies for Chrome and establish a formal browser patch-management process with SLAs requiring critical updates within 7 days of release.

Google Chrome CVE-2026-11648

EUVD-2026-35248 HIGH

Use After Free (CWE-416)

2026-06-09 chrome-cve-admin@google.com

GHSA-8jhq-p4mq-387j

Google Memory Corruption Use After Free Microsoft Denial Of Service

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 11:25 vuln.today

CVSS changed

Jun 09, 2026 - 11:22 NVD

8.8 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in FullScreen in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Heap corruption via use-after-free in Google Chrome's FullScreen component on Windows prior to 149.0.7827.103 enables remote attackers to potentially achieve code execution when a victim visits a malicious HTML page. Chromium rates this High severity and a vendor patch is available, though no public exploit has been identified at time of analysis. The CVSS 8.8 score reflects the network-reachable, low-complexity nature of the bug, tempered by required user interaction (UI:R).

Technical ContextAI

The flaw is a CWE-416 Use-After-Free in Chrome's FullScreen subsystem, which manages the Fullscreen API lifecycle (requestFullscreen/exitFullscreen) and associated DOM/widget state. Use-after-free bugs occur when memory referenced by a dangling pointer is reallocated and then dereferenced, allowing attacker-controlled data to be interpreted as object state, vtable pointers, or function pointers. In Chrome's multi-process Blink/Content architecture, such bugs in renderer-side UI code typically yield renderer-process compromise, which combined with a sandbox escape can lead to full code execution on the host. The bug is specific to the Windows build per the description, suggesting platform-specific windowing or widget code paths in the FullScreen implementation.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.103 for Windows - update via the built-in updater (chrome://settings/help) or push through enterprise management (Chrome Browser Cloud Management, Group Policy, or Intune) and restart the browser to apply. Confirm the rollout via the Stable Channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html and track the upstream report at https://issues.chromium.org/issues/506684534. As a compensating control until updates land, restrict access to untrusted sites via SafeBrowsing Enhanced Protection and enterprise URL allowlists, and consider blocking the Fullscreen API in high-risk fleets through the FullscreenAllowedForUrls / DefaultFullscreenSetting policies - this breaks legitimate full-screen video and presentation use cases. For Chromium-derivative browsers, monitor each vendor's release notes and apply their equivalent merge as soon as published.