What is the CVSS score of CVE-2026-11681?

CVE-2026-11681 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11681?

Google Chrome for Linux contains a heap corruption vulnerability (CVE-2026-11681, CVSS 8.8) enabling arbitrary code execution when users visit a malicious website; no public exploit identified at…. A patch is available.

How to fix or mitigate CVE-2026-11681?

Within 24 hours: Identify all Linux systems running Chrome versions before 149.0.7827.103 and issue security advisory with patch information to users and system administrators. Within 7 days: Deploy Chrome 149.0.7827.103 or later through standard update mechanisms; prioritize systems in high-risk roles and Linux server environments. Within 30 days: Audit version compliance across the Linux fleet; establish monitoring for exploitation attempts and anomalous browser behavior.

Google Chrome CVE-2026-11681

EUVD-2026-35207 HIGH

Use After Free (CWE-416)

2026-06-09 chrome-cve-admin@google.com

GHSA-mhrm-mf55-j4p7

Denial Of Service Use After Free Memory Corruption Google

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 11:30 vuln.today

CVSS changed

Jun 09, 2026 - 11:22 NVD

8.8 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Ozone in Google Chrome on Linux prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Heap corruption in Google Chrome's Ozone component on Linux before version 149.0.7827.103 allows remote attackers to potentially achieve arbitrary code execution within the browser process when a victim visits a crafted HTML page. The flaw is a use-after-free rated High severity by Chromium, with CVSS 8.8 reflecting network-reachable exploitation requiring only minimal user interaction. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.

Technical ContextAI

Ozone is Chromium's platform abstraction layer for low-level windowing, input, and graphics on Linux (and Chrome OS), bridging the browser to backends such as X11 and Wayland. The vulnerability is a CWE-416 Use-After-Free, where an object is freed while a reference to it remains live, allowing later access to reclaimed memory and enabling heap corruption. In a renderer or browser-side Ozone path, such corruption can be steered into a controlled write or type-confusion primitive, which historically maps to sandboxed code execution in Chrome and forms the first stage of a multi-bug exploit chain.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.103 for Linux; update affected endpoints to this version or later via the standard stable channel update described at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html. For managed fleets, push the update through your Chrome enterprise policy or package manager and verify chrome://version reports 149.0.7827.103+; restart all browser processes since Chrome does not apply binary updates until relaunch. Users of Chromium-derived browsers should monitor their respective vendors for backported builds and update once available. As an interim compensating control before patching, restrict browsing on Linux workstations to trusted sites (URL allowlists via enterprise policy) and ensure site isolation is enabled (default) so that a crafted page is confined to a per-site renderer - this does not block the bug but raises the cost of a useful exploit chain; disabling JavaScript would reduce reachability but is generally too disruptive for production use.