What is the CVSS score of EUVD-2026-35214?

EUVD-2026-35214 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by EUVD-2026-35214?

A critical vulnerability in Google Chrome (CVE-2026-11688, CVSS 8.8) allows remote attackers to execute arbitrary code on employee systems through compromised or malicious websites, without requiring…. A patch is available.

How to fix or mitigate EUVD-2026-35214?

Within 24 hours: Identify and inventory all systems running Google Chrome versions prior to 149.0.7827.103, and estimate affected user population across the organization. Within 7 days: Deploy and roll out Google Chrome version 149.0.7827.103 or later to all affected systems and verify patch compliance. Within 30 days: Audit application and system logs for suspicious renderer process activity, revalidate 100% patch deployment, and brief security operations teams on exploitation indicators for threat monitoring.

Google Chrome EUVD-2026-35214

| CVE-2026-11688 HIGH

Code Injection (CWE-94)

2026-06-09 chrome-cve-admin@google.com

GHSA-45pg-448j-3rfq

Code Injection Google RCE

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 02:39 vuln.today

CVSS changed

Jun 09, 2026 - 01:22 NVD

8.8 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 8.8

DescriptionCVE.org

Inappropriate implementation in SVG in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandboxed remote code execution in Google Chrome versions prior to 149.0.7827.103 allows a remote attacker to execute arbitrary code within the renderer sandbox by enticing a user to visit a crafted HTML page that abuses an inappropriate SVG implementation. Google rates the underlying Chromium issue as High severity, and no public exploit identified at time of analysis, though the user-interaction requirement (UI:R) and high CVSS of 8.8 make this a meaningful drive-by browsing risk once a patch is reverse-engineered.

Technical ContextAI

The flaw resides in Chrome's SVG (Scalable Vector Graphics) rendering pipeline, which is implemented within the Blink rendering engine and processes complex declarative graphics directly inside the renderer process. The CWE-94 (Improper Control of Generation of Code, i.e., Code Injection) classification combined with the 'inappropriate implementation' language used by Google typically indicates a logic flaw in how SVG content is parsed, validated, or handed to downstream subsystems, allowing attacker-controlled data to influence code execution paths. Because exploitation yields execution 'inside a sandbox' (Scope: Unchanged), the attacker initially gains code execution constrained by Chrome's renderer sandbox rather than full host compromise, though such primitives are commonly chained with separate sandbox-escape bugs in real-world attack chains.

RemediationAI

Upgrade Google Chrome to 149.0.7827.103 or later on the Stable Desktop channel as published in the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html); this is the vendor-released patch and is the primary fix. Enterprises managing Chrome via policy should force-restart browsers after auto-update to ensure the patched binary is loaded, since Chrome only activates updates on relaunch. If patching must be deferred, restrict browsing to trusted sites via SmartScreen/SafeBrowsing enforcement and an outbound web proxy allowlist, and consider enforcing the SitePerProcess and IsolateOrigins policies to maximize the value of the renderer sandbox boundary - the trade-off is increased memory usage per tab. Chromium-derived browsers should be updated to their equivalent downstream releases once published.