What is the CVSS score of CVE-2026-11698?

CVE-2026-11698 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11698?

Google Chrome on macOS prior to version 149.0.7827.103 contains a heap corruption vulnerability (CVE-2026-11698) enabling remote code execution through malicious webpages; no public exploit…. A patch is available.

How to fix or mitigate CVE-2026-11698?

Within 24 hours: Issue urgent security directive requiring Chrome update to 149.0.7827.103 or later; activate forced auto-update if available in your MDM platform. Within 7 days: Verify through asset management that 100% of macOS Chrome installations report version 149.0.7827.103 or later; document and report compliance status. Within 30 days: Establish mandatory auto-update policies for Chrome to eliminate patch lag; audit and strengthen other browser security controls.

Google Chrome CVE-2026-11698

EUVD-2026-35224 HIGH

Use After Free (CWE-416)

2026-06-09 chrome-cve-admin@google.com

GHSA-6g5p-fx5j-3r2q

Denial Of Service Use After Free Memory Corruption Google

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 02:37 vuln.today

CVSS changed

Jun 09, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Heap corruption in Google Chrome on macOS prior to version 149.0.7827.103 allows remote attackers to potentially execute arbitrary code by luring a victim to a crafted HTML page that triggers a use-after-free in the browser's Bluetooth component. Google has released a patched stable channel update, and while no public exploit has been identified at time of analysis, the CVSS 8.8 score reflects the high impact achievable with only a single user click. CISA SSVC currently scores exploitation as 'none' but technical impact as 'total', consistent with a serious but not yet weaponized browser flaw.

Technical ContextAI

The flaw resides in the Web Bluetooth implementation within Chromium's browser process on macOS, which exposes JavaScript APIs allowing web pages to discover and communicate with nearby Bluetooth Low Energy devices. CWE-416 (Use After Free) means the code continues to reference a heap object after it has been freed, enabling an attacker who can control subsequent heap allocations to place attacker-controlled data where a freed object's vtable, callback pointer, or other dereferenced field once lived. Chromium's Bluetooth stack involves complex asynchronous object lifetimes across IPC boundaries between the renderer and browser process, a class of bug Chromium's security team has historically tracked as 'High' severity because it can lead to memory corruption in a privileged process. The macOS-specific scoping in the description suggests the bug lies in platform-specific code paths in Chrome's CoreBluetooth integration rather than the cross-platform Bluetooth logic.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.103 for macOS - update via Chrome's built-in updater (chrome://settings/help) or enterprise management tooling, then restart the browser to apply. Enterprise administrators should push the update via Jamf, Munki, or Chrome Browser Cloud Management and confirm rollout in their inventory. Until patching completes, a workable compensating control is to disable Web Bluetooth by setting the DefaultWebBluetoothGuardSetting enterprise policy to 2 (Block) via a configuration profile - the trade-off is that any internal web app relying on Web Bluetooth (rare, but used in some IoT/medical/industrial dashboards) will stop functioning. Restricting users from visiting untrusted sites or enforcing Safe Browsing Enhanced Protection adds defense in depth but does not substitute for patching. Refer to the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html for full release notes.