What is the CVSS score of CVE-2026-11651?

CVE-2026-11651 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11651?

A critical remote code execution vulnerability in Google Chrome (CVE-2026-11651) affects all users running versions prior to 149.0.7827.103, enabling attackers to execute arbitrary code within the…. A patch is available.

How to fix or mitigate CVE-2026-11651?

Within 24 hours: Identify all Chrome installations and current versions; communicate to all users to avoid clicking suspicious links. Within 7 days: Deploy Chrome version 149.0.7827.103 or later through your standard patch management process to all endpoints. Within 30 days: Verify 100% deployment completion and implement endpoint monitoring to detect any exploitation attempts.

Google Chrome CVE-2026-11651

EUVD-2026-35251 CRITICAL

Use After Free (CWE-416)

2026-06-09 chrome-cve-admin@google.com

GHSA-fc3m-2949-gq3c

Google Memory Corruption RCE Use After Free Denial Of Service

9.6

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 02:46 vuln.today

CVSS changed

Jun 09, 2026 - 02:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

CRITICAL 9.6

DescriptionCVE.org

Use after free in Network in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Articles & Coverage 1

News Critical RCE in Google Chrome 149.0.7827.103 Network Component - CVE-2026-11651 Jun 09, 2026

AnalysisAI

Remote code execution in Google Chrome's Network component before version 149.0.7827.103 allows a remote attacker to execute arbitrary code within the renderer sandbox by luring a user to a crafted HTML page. The flaw is a use-after-free (CWE-416) classified High severity by Chromium with a CVSS 9.6 due to scope change and user-interaction prerequisite. No public exploit identified at time of analysis, but a vendor patch is already shipped via the Stable channel update.

Technical ContextAI

The vulnerability resides in Chrome's Network stack, the component responsible for handling HTTP/HTTPS traffic, fetch requests, and other network primitives exposed to web content. CWE-416 (Use-After-Free) means an object in the Network module is freed while a dangling pointer still references it; subsequent dereference allows an attacker to control memory contents at the freed location, leading to arbitrary code execution within the sandboxed renderer/network process. The affected platform is Chromium-based Google Chrome desktop builds prior to 149.0.7827.103, the version line tracked in the Chromium issue tracker entry 511736002.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.103 - update via the Stable channel update for desktop announced at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html, then restart the browser to load the patched binary. Enterprises managing Chrome via policy should force the auto-update or push the patched MSI/PKG through their endpoint management tooling and verify chrome://version reflects 149.0.7827.103 or later. For Chromium downstreams (Edge, Brave, Opera, Vivaldi), monitor the respective vendor advisories and apply their merged builds. No vendor-supplied workaround is documented; as a compensating control until patching completes, restrict browsing to trusted sites via enterprise URL allowlisting (trade-off: breaks general web usage), or rely on Chrome's site isolation and sandbox - noting that this CVE explicitly describes RCE inside the sandbox, so site isolation alone does not neutralize the bug.