What is the CVSS score of CVE-2026-11662?

CVE-2026-11662 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11662?

Google Chrome versions prior to 149.0.7827.103 contain a remote code execution vulnerability in the Bindings layer that allows attackers to execute arbitrary code within the renderer sandbox when…. A patch is available.

How to fix or mitigate CVE-2026-11662?

24 hours: Identify all systems running Chrome versions prior to 149.0.7827.103 through endpoint inventory tools. 7 days: Deploy Chrome version 149.0.7827.103 or later organization-wide using your standard patch distribution mechanism; prioritize high-value workstations and executive devices. 30 days: Confirm 100% patching completion through automated compliance scanning and enable Chrome auto-update policies to prevent regression.

Google Chrome CVE-2026-11662

EUVD-2026-35262 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-06-09 chrome-cve-admin@google.com

GHSA-37wr-36rm-9m57

Google Memory Corruption RCE

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 02:44 vuln.today

CVSS changed

Jun 09, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 8.8

DescriptionCVE.org

Type Confusion in Bindings in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome versions prior to 149.0.7827.103 allows a remote attacker to execute arbitrary code within the renderer sandbox by enticing a victim to visit a crafted HTML page. The flaw stems from a type confusion bug in Chromium's Bindings layer (CWE-843), rated High severity by Chromium and CVSS 8.8 due to network-based exploitation requiring only user interaction. No public exploit identified at time of analysis and EPSS data was not provided, but Chromium V8/bindings issues historically attract exploit development.

Technical ContextAI

The vulnerability resides in Chrome's Bindings subsystem, the boundary layer that translates between JavaScript objects and underlying C++ Blink/V8 implementations of Web APIs and DOM interfaces. CWE-843 (Access of Resource Using Incompatible Type) means the code accesses a memory object assuming one type while it is actually another, which in a C++ engine like Blink leads to attacker-controlled vtable, field offset, or pointer dereference primitives. Exploitation typically yields read/write within the renderer process address space, which can be chained into arbitrary code execution constrained to the renderer sandbox. The affected product per the Chromium release notes is the Stable channel of Chrome on desktop platforms, with the fix landing in 149.0.7827.103.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.103 - upgrade the Stable channel desktop browser to this version or later, distributing via managed update channels (Chrome Enterprise, MDM, or forced restart policies) since the embedded updater requires a relaunch to apply. Confirm fixed builds via the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html and verify via chrome://settings/help on endpoints. As no Chrome-side workaround exists for a Bindings type-confusion bug, compensating controls until patching completes include enforcing site isolation (already default), enabling Enhanced Safe Browsing to block known malicious pages with the trade-off of additional telemetry to Google, restricting browsing to allow-listed business sites via proxy or DNS filtering at the cost of user productivity friction, and ensuring host EDR is configured to alert on anomalous child processes spawned by chrome.exe. For Chromium derivatives (Edge, Brave, Electron apps), apply the corresponding vendor update once published.