What is the CVSS score of CVE-2026-11694?

CVE-2026-11694 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11694?

Google Chrome versions prior to 149.0.7827.103 contain a high-severity vulnerability (CVE-2026-11694) enabling arbitrary code execution within compromised browser processes.. A patch is available.

How to fix or mitigate CVE-2026-11694?

Within 24 hours: Deploy Chrome version 149.0.7827.103 or later organization-wide; enable auto-update enforcement if not already active; issue mandatory user notification. Within 7 days: Verify 100% update compliance across all endpoints through endpoint management telemetry. Within 30 days: Monitor threat intelligence feeds and security logs for any exploitation attempts or evidence of active renderer-level compromises.

Google Chrome CVE-2026-11694

EUVD-2026-35220 HIGH

Use After Free (CWE-416)

2026-06-09 chrome-cve-admin@google.com

GHSA-qhww-xqqg-m6hv

Google Memory Corruption RCE Use After Free Denial Of Service

7.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 02:37 vuln.today

CVSS changed

Jun 09, 2026 - 01:22 NVD

7.5 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 7.5

DescriptionCVE.org

Use after free in ServiceWorker in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandboxed remote code execution in Google Chrome versions prior to 149.0.7827.103 allows attackers who have already compromised the renderer process to execute arbitrary code via a crafted HTML page that triggers a use-after-free in the ServiceWorker component. Rated High severity by Chromium with a CVSS 7.5, the flaw requires user interaction (visiting a malicious page) and a pre-existing renderer compromise, and no public exploit has been identified at time of analysis. The vendor has released a patched Stable channel update.

Technical ContextAI

The vulnerability lives in Chrome's ServiceWorker implementation, the browser subsystem that runs JavaScript-based background workers to intercept network requests, drive push notifications, and support offline web apps. The root cause is CWE-416 (Use After Free): a ServiceWorker object is freed but a dangling pointer is later dereferenced, allowing an attacker to manipulate the freed memory region to corrupt control-flow or object state. Because ServiceWorkers run in the renderer process, exploitation of this bug yields code execution inside the renderer sandbox rather than at the browser-broker privilege level, meaning it typically functions as one stage of a multi-bug exploit chain rather than a full sandbox escape on its own.

RemediationAI

Update Google Chrome to 149.0.7827.103 or later via the Stable channel; the patch is available per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html and tracked in the upstream issue https://issues.chromium.org/issues/517705966. For managed fleets, force an update via enterprise policy and restart browsers to apply the fix, as Chrome updates only take effect after a relaunch. If patching must be delayed, compensating controls include disabling ServiceWorker registration via the DefaultSensorsSetting / URL-blocklisted origins enterprise policies for high-risk sites (trade-off: breaks offline PWAs and push notifications), restricting browsing to trusted sites via site isolation and content filtering, and ensuring strict site isolation is enabled (already default) so a compromised renderer is confined to one origin. Users of Chromium-based browsers (Edge, Brave, Opera) should also upgrade once their vendor ships a rebased build.