What is the CVSS score of CVE-2026-11649?

CVE-2026-11649 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11649?

Google Chrome vulnerabilities affecting employee computers pose a direct risk to sensitive corporate data and system integrity.. A patch is available.

How to fix or mitigate CVE-2026-11649?

Within 24 hours: Initiate communication to all Chrome users and enable automatic Chrome updates if not already configured. Within 7 days: Verify deployment of Chrome version 149.0.7827.103 or later across all organization devices through endpoint management tools or automatic update verification. Within 30 days: Conduct full compliance audit to confirm all Chrome instances meet version 149.0.7827.103 or later and establish processes for rapid deployment of critical security updates.

Google Chrome CVE-2026-11649

EUVD-2026-35249 HIGH

Use After Free (CWE-416)

2026-06-09 chrome-cve-admin@google.com

GHSA-2hgr-cprg-9825

Google Memory Corruption RCE Use After Free Denial Of Service

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 02:47 vuln.today

CVSS changed

Jun 09, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome's V8 JavaScript engine prior to version 149.0.7827.103 allows attackers to execute arbitrary code within the renderer sandbox by luring a user to a crafted HTML page. The flaw is a use-after-free memory corruption issue rated High severity by Chromium, with a CVSS 8.8 score reflecting low attack complexity but requiring user interaction. No public exploit identified at time of analysis, though V8 use-after-frees historically attract rapid weaponization for browser exploit chains.

Technical ContextAI

V8 is Google's open-source high-performance JavaScript and WebAssembly engine that powers Chrome, Chromium-based browsers (Edge, Opera, Brave), and Node.js. The root cause is CWE-416 (Use After Free), where memory is referenced after being freed - typically due to incorrect lifetime management in V8's optimizing compilers (TurboFan, Maglev) or garbage collector (Orinoco). When a freed object is reused with attacker-controlled data, the dangling pointer enables arbitrary read/write primitives that can be escalated to code execution within the V8 isolate. Code execution remains constrained to Chrome's renderer sandbox; full system compromise requires a separate sandbox escape.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.103 or later on the Stable channel - update via Chrome's built-in updater (chrome://settings/help) or via managed deployment tools (Chrome Browser Cloud Management, Intune, JAMF, WSUS). Confirm Chromium-derivative browsers (Edge, Brave, Opera, Vivaldi) have absorbed the equivalent V8 fix before declaring fleets remediated. Refer to the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html and the Chromium issue at https://issues.chromium.org/issues/511270083. If patching is delayed, compensating controls include disabling the V8 optimizer via the --js-flags='--no-opt' command-line switch (degrades JavaScript performance significantly on modern web apps), enforcing Site Isolation (chrome://flags/#enable-site-per-process) which is on by default but worth verifying, restricting browsing to allowlisted sites via enterprise policy (URLAllowlist/URLBlocklist), and using EDR/browser-isolation tooling to neutralize untrusted HTML payloads - note that --no-opt breaks some web apps and URL allowlisting impacts user productivity.