What is the CVSS score of EUVD-2026-34575?

EUVD-2026-34575 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by EUVD-2026-34575?

Google Chrome on macOS versions below 149.0.7827.53 contains a critical sandbox escape vulnerability that could allow attackers to achieve full system compromise if they can first inject code into…. A patch is available.

How to fix or mitigate EUVD-2026-34575?

Within 24 hours: Identify all macOS systems running Chrome and notify users of the vulnerability. Within 7 days: Deploy Chrome version 149.0.7827.53 or later to all macOS endpoints, prioritizing engineering and administrative users. Within 30 days: Verify 100% deployment completion via endpoint management tools and document remediation.

Google Chrome EUVD-2026-34575

| CVE-2026-11114 CRITICAL

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-qf39-8qpw-5cwj

Denial Of Service Use After Free Memory Corruption Google Chrome

Critical

Disputed · 9.6 NVD

Severity by source

Sources disagree (Medium–Critical)

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Red Hat

8.2 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 04:25 vuln.today

CVSS changed

Jun 06, 2026 - 04:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:17 nvd

CRITICAL 9.6

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Device Trust in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome on macOS prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page that triggers a use-after-free in the Device Trust component. The flaw carries a CVSS 9.6 due to scope change and full CIA impact, though Chromium rates the underlying severity as Medium and EPSS is very low (0.03%, 11th percentile); no public exploit identified at time of analysis.

Technical ContextAI

The vulnerability resides in Chrome's Device Trust subsystem, which integrates with enterprise device-trust connectors to attest endpoint posture to web origins. The root cause is CWE-416 (Use After Free): an object in the Device Trust code path is freed while a dangling reference remains reachable, and subsequent reuse of that memory enables an attacker controlling the renderer to corrupt browser-process state. Because Device Trust logic crosses the renderer/browser IPC boundary, a freed object reused in the privileged browser process effectively lifts attacker-controlled code or data out of the renderer sandbox. The affected platform is specifically the macOS build of Chrome (Chromium-based), per the upstream Chromium issue 501360342 and the Stable Channel update advisory.

RemediationAI

Vendor-released patch: update Chrome on macOS to 149.0.7827.53 or later via the Stable Channel (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html); enterprise fleets should push the update through their existing Chrome management (Google Admin console, Jamf, Intune, or MDM) and verify via chrome://settings/help. No specific workaround is published, but because exploitation requires a compromised renderer as a precondition, defense-in-depth measures that reduce renderer compromise materially reduce risk: enable Enhanced Safe Browsing (trade-off: sends more telemetry to Google), enforce Site Isolation (default on, but verify chrome://flags hasn't been altered), and where feasible disable or restrict the Device Trust connector via the BrowserContextAwareAccessSignalsAllowlist enterprise policy until patched (trade-off: breaks enterprise device-attestation workflows for the affected origins).