What is the CVSS score of CVE-2026-11687?

CVE-2026-11687 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11687?

Google Chrome on macOS versions prior to 149.0.7827.103 contains a vulnerability enabling remote code execution when users visit crafted websites; no public exploit has been identified at time of…. A patch is available.

How to fix or mitigate CVE-2026-11687?

Within 24 hours: Notify all macOS users on Chrome versions prior to 149.0.7827.103 and prepare automated deployment. Within 7 days: Deploy Chrome 149.0.7827.103 or later to all macOS Chrome installations. Within 30 days: Verify 100% patch compliance across all macOS endpoints and monitor for suspicious activity patterns.

Google Chrome CVE-2026-11687

EUVD-2026-35213 HIGH

Use After Free (CWE-416)

2026-06-09 chrome-cve-admin@google.com

GHSA-qv8p-84pr-826v

Denial Of Service Use After Free Memory Corruption Google

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 02:39 vuln.today

CVSS changed

Jun 09, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Dawn in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Heap corruption in Google Chrome on macOS prior to 149.0.7827.103 enables remote attackers to potentially execute arbitrary code by luring a user to a crafted HTML page that exploits a use-after-free in the Dawn WebGPU implementation. The flaw carries a CVSS 8.8 (High) rating and Chromium rates it High severity; no public exploit has been identified at time of analysis, but Chrome browser bugs of this class are historically attractive targets for in-the-wild exploitation. Patch is available from Google.

Technical ContextAI

Dawn is Chromium's cross-platform implementation of the WebGPU standard, providing a low-level GPU API to web content via the browser's renderer process. The root cause is CWE-416 (Use After Free): memory referenced by a pointer is freed but the pointer is subsequently dereferenced, allowing an attacker who can influence the reallocation of that memory region to corrupt the heap and steer execution. Because Dawn handles attacker-controlled WebGPU command streams from JavaScript, a malicious HTML page can drive the allocation/free sequence needed to trigger the bug. The platform scope is specifically macOS per the Chrome advisory, which typically reflects Dawn's Metal backend implementation rather than the cross-platform abstraction layer.

RemediationAI

Vendor-released patch: update Google Chrome on macOS to 149.0.7827.103 or later via the Stable channel update referenced at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html; Chrome will auto-update on restart, so administrators should force-relaunch browsers across the fleet to ensure the fix is loaded. As a temporary compensating control until patching completes, WebGPU can be disabled by setting the chrome://flags/#enable-unsafe-webgpu flag to Disabled and, for managed fleets, deploying the Chrome enterprise policy to disable WebGPU - note that this will break legitimate sites and web apps that depend on GPU acceleration via WebGPU (3D visualization, ML demos, some games). Endpoint protection and macOS Gatekeeper do not mitigate this in-browser memory corruption, so patching is the only durable fix.