What is the CVSS score of CVE-2026-11664?

CVE-2026-11664 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11664?

Google Chrome contains a code execution vulnerability (CVSS 8.8) that could be triggered when users visit compromised or malicious websites.. A patch is available.

How to fix or mitigate CVE-2026-11664?

Within 24 hours: Identify all Chrome deployments and users across your organization. Within 7 days: Deploy Chrome version 149.0.7827.103 or later through your patch management system to all affected systems. Within 30 days: Confirm full deployment completion via audit or telemetry to ensure no vulnerable versions remain.

Google Chrome CVE-2026-11664

EUVD-2026-35264 HIGH

Use After Free (CWE-416)

2026-06-09 chrome-cve-admin@google.com

GHSA-c668-r5mr-qr6c

Denial Of Service Use After Free Memory Corruption Google

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 11:27 vuln.today

CVSS changed

Jun 09, 2026 - 11:22 NVD

8.8 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Payments in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Heap corruption in Google Chrome's Payments component before 149.0.7827.103 allows remote attackers to exploit a use-after-free condition by enticing a victim to visit a crafted HTML page, potentially achieving arbitrary code execution within the renderer sandbox. Chromium rates the severity as High, and CVSS 8.8 reflects network-reachable exploitation with low complexity, though successful exploitation requires user interaction (visiting an attacker-controlled page). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

The flaw resides in the Payments subsystem of Chromium, the open-source browser engine underlying Google Chrome and many derivative browsers (Edge, Brave, Opera, Vivaldi). CWE-416 (Use After Free) occurs when memory is referenced after it has been freed, typically because object lifetime is mismanaged across asynchronous operations or event handlers - a common pattern in Chromium's multi-process renderer/IPC architecture. In the Payments component, this likely involves dangling pointers to PaymentRequest or related JavaScript-exposed objects whose backing C++ state is released while still reachable, enabling heap layout manipulation and corruption of adjacent allocations. Affected CPE corresponds to Chrome versions prior to 149.0.7827.103 on desktop platforms (Windows, macOS, Linux).

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.103 (Stable channel desktop update). Update Chrome immediately via the built-in updater (chrome://settings/help) or push the new build through enterprise management (Chrome Browser Cloud Management, Group Policy, Jamf, Intune); see the advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html and the upstream tracker at https://issues.chromium.org/issues/513830374. For Chromium-based downstream browsers, install the corresponding rebased release once published by each vendor. As a temporary compensating control while updates roll out, consider disabling the Payment Request API via enterprise policy (PaymentMethodPrivacyEnabled / blocking payment handlers) to remove the vulnerable code path - note this will break legitimate one-click checkout flows on e-commerce sites. Web filtering to block untrusted sites reduces exposure to crafted HTML payloads but does not eliminate risk from compromised legitimate sites or ad networks.