What is the CVSS score of CVE-2026-11699?

CVE-2026-11699 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11699?

Google Chrome on macOS versions prior to 149.0.7827.103 contain a heap corruption vulnerability in the Bluetooth component that allows remote code execution when users visit attacker-controlled…. A patch is available.

How to fix or mitigate CVE-2026-11699?

Within 24 hours: Identify all macOS systems running Chrome and verify current version. Within 7 days: Deploy Chrome 149.0.7827.103 or later to all affected macOS systems through your standard patch management process. Within 30 days: Audit patch deployment completion and review browser logs for any indicators of exploitation attempts.

Google Chrome CVE-2026-11699

EUVD-2026-35225 HIGH

Use After Free (CWE-416)

2026-06-09 chrome-cve-admin@google.com

GHSA-wffw-9j7c-5pwf

Denial Of Service Use After Free Memory Corruption Google

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 02:37 vuln.today

CVSS changed

Jun 09, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Heap corruption in Google Chrome on macOS prior to version 149.0.7827.103 can be triggered remotely through a crafted HTML page that exploits a use-after-free condition in the browser's Bluetooth component. Successful exploitation requires the victim to visit attacker-controlled content but no authentication, and Google has rated the underlying Chromium severity as High with no public exploit identified at time of analysis.

Technical ContextAI

The flaw resides in Chrome's Bluetooth implementation, which exposes Web Bluetooth APIs allowing web pages to communicate with nearby Bluetooth devices via JavaScript. The root cause is CWE-416 (Use After Free), a memory safety class where a pointer to freed heap memory is dereferenced, typically because object lifetime tracking between the renderer process, the Bluetooth service, and Mojo IPC bindings is mismanaged. On macOS, Chrome's Bluetooth stack interacts with Apple's CoreBluetooth framework via dedicated service processes, and freed objects in this path can be reclaimed with attacker-controlled data to corrupt heap metadata or vtable pointers, enabling arbitrary code execution within the renderer or affected service process.

RemediationAI

Apply the vendor-released patch by upgrading Google Chrome on macOS to version 149.0.7827.103 or later via the Stable channel update documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html; restart the browser after update to ensure the patched binary is loaded. For managed fleets, push the update through MDM (Jamf, Intune, Kandji) and verify rollout via chrome://version. As an interim compensating control where patching is delayed, disable the Web Bluetooth API by setting the DefaultWebBluetoothGuardSetting enterprise policy to 2 (BlockWebBluetooth), which neutralizes the attack surface at the cost of breaking any internal tooling that relies on Web Bluetooth; blocking outbound access to untrusted web content for high-value macOS endpoints is a heavier-handed alternative. Track upstream bug context at https://issues.chromium.org/issues/518237527 and the EUVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-11699.