What is the CVSS score of CVE-2026-11670?

CVE-2026-11670 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11670?

Google Chrome versions prior to 149.0.7827.103 contain a use-after-free vulnerability in the PDF handler that allows remote code execution if a user opens a malicious PDF file.. A patch is available.

How to fix or mitigate CVE-2026-11670?

Within 24 hours: Audit Chrome deployment inventory and alert users to defer opening untrusted PDFs. Within 7 days: Deploy Chrome version 149.0.7827.103 or later across all endpoints via your patch management system; prioritize users who frequently handle external PDFs. Within 30 days: Verify 100% deployment completion and monitor endpoint logs for suspicious PDF-rendering crashes or process anomalies.

Google Chrome CVE-2026-11670

EUVD-2026-35270 HIGH

Use After Free (CWE-416)

2026-06-09 chrome-cve-admin@google.com

GHSA-66p7-vqr8-2m3v

Google Memory Corruption RCE Use After Free Denial Of Service

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 02:43 vuln.today

CVSS changed

Jun 09, 2026 - 01:22 NVD

8.8 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in PDF in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome versions prior to 149.0.7827.103 stems from a use-after-free flaw in the PDF component, enabling a remote attacker who lures a user into opening a crafted PDF to execute arbitrary code within the renderer sandbox. Rated High by Chromium with CVSS 8.8, the issue requires user interaction but no authentication, and currently has no public exploit identified at time of analysis.

Technical ContextAI

The vulnerability resides in Chrome's PDF subsystem, which is built on the PDFium library embedded within the browser. CWE-416 (Use After Free) describes a class of memory-safety bugs where code continues to reference memory after it has been freed, often allowing an attacker to control the contents of the freed object and hijack execution flow when the dangling pointer is dereferenced. Chrome runs PDF parsing inside a sandboxed renderer process, which constrains the immediate impact of code execution to that sandbox boundary; however, such bugs are commonly chained with a sandbox-escape primitive to achieve full system compromise. Affected products per vendor data are Google Chrome desktop builds before 149.0.7827.103.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.103 - upgrade all desktop Chrome installations to this version or later via the Stable Channel update described at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html, and verify deployment by checking chrome://settings/help. For managed fleets, push the update via group policy or MDM and enforce a browser restart, since Chrome only completes the update after relaunch. As an interim compensating control while patches roll out, disable the built-in PDF viewer by setting the AlwaysOpenPdfExternally policy to true, which routes PDFs to an external handler - the trade-off is loss of in-browser PDF rendering and reliance on whatever external viewer handles the file, which may have its own vulnerabilities. Organizations using Chromium-derived browsers (Edge, Brave, Opera) should track and apply their respective vendor updates once they integrate the upstream PDFium fix.