What is the CVSS score of CVE-2026-11674?

CVE-2026-11674 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11674?

A high-severity remote code execution vulnerability (CVSS 8.8) in Google Chrome's Guest View component affects all users running versions prior to 149.0.7827.103.. A patch is available.

How to fix or mitigate CVE-2026-11674?

Within 24 hours: Inventory all enterprise Chrome installations and identify systems running versions prior to 149.0.7827.103; prioritize executive and high-risk user devices. Within 7 days: Deploy Chrome 149.0.7827.103 (stable channel) to all affected endpoints; ensure automatic Chrome updates are enabled organization-wide. Within 30 days: Verify patch deployment completion, audit Chrome versions fleet-wide, and implement endpoint monitoring for exploitation attempts.

Google Chrome CVE-2026-11674

EUVD-2026-35274 HIGH

Use After Free (CWE-416)

2026-06-09 chrome-cve-admin@google.com

GHSA-855r-9wvc-25gh

Google Memory Corruption RCE Use After Free Denial Of Service

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 02:42 vuln.today

CVSS changed

Jun 09, 2026 - 01:22 NVD

8.8 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Guest View in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome's Guest View component prior to version 149.0.7827.103 allows attackers to execute arbitrary code within the renderer sandbox by luring users to a crafted HTML page. The flaw is a use-after-free memory corruption issue rated High severity by Chromium with a CVSS of 8.8, and while no public exploit has been identified at time of analysis, Google has shipped a patched stable channel build. Exploitation requires user interaction (visiting a malicious page) and code execution is confined to the sandbox, meaning a sandbox escape would be needed for full host compromise.

Technical ContextAI

Guest View is the Chromium subsystem that hosts embedded out-of-process content such as <webview> tags used by Chrome Apps and extensions, MimeHandlerView, and other guest frame types. CWE-416 (Use After Free) describes a class of memory safety defects where freed heap memory is dereferenced through a dangling pointer, frequently leading to controlled writes, type confusion, or function pointer hijack - well-understood primitives that browser exploit developers chain into arbitrary read/write and ultimately code execution in the renderer process. The affected codebase is Chromium-based, so downstream browsers (Edge, Brave, Opera, Vivaldi, Electron, CEF embedders) built from pre-149.0.7827.103 sources are likely impacted until they take the upstream fix.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.103 on the stable desktop channel - install immediately via Chrome's built-in updater (chrome://settings/help) or push the update through enterprise management (Group Policy, Jamf, Intune) per Google's advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html. For Chromium-based browsers and Electron applications, monitor your vendor for a downstream release that incorporates the fix, tracked upstream at https://issues.chromium.org/issues/516910450. If patching must be delayed, compensating controls include disabling or restricting use of <webview> and guest view-dependent extensions/apps via the ExtensionInstallBlocklist enterprise policy (side effect: breaks legitimate apps that rely on webview), enforcing site isolation (already default), and steering high-risk users to an alternative non-Chromium browser temporarily (side effect: workflow disruption and lost extension compatibility).