What is the CVSS score of EUVD-2026-35228?

EUVD-2026-35228 has a contested CVSS base score of 6.8 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for EUVD-2026-35228?

Yes, a patch is available for EUVD-2026-35228. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-35228

| CVE-2026-11628 MEDIUM

Use After Free (CWE-416)

2026-06-09 chrome-cve-admin@google.com

GHSA-3wm7-483h-66xg

Denial Of Service Use After Free Memory Corruption Google

Medium

Disputed · 6.8 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

6.8 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

6.6 HIGH

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 03:01 vuln.today

CVSS changed

Jun 09, 2026 - 02:22 NVD

6.8 (MEDIUM)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

MEDIUM 6.8

DescriptionCVE.org

Use after free in Ozone in Google Chrome prior to 149.0.7827.103 allowed a local attacker to potentially exploit heap corruption via physical access to the device. (Chromium security severity: Critical)

AnalysisAI

Heap corruption via use-after-free in Chrome's Ozone display subsystem (versions prior to 149.0.7827.103) enables a local attacker with physical device access to achieve high-impact compromise across confidentiality, integrity, and availability. The CVSS vector (AV:P/AC:L/PR:N/UI:N) confirms physical presence is the primary prerequisite, with no authentication or user interaction required once access is obtained. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available in Chrome 149.0.7827.103.

Technical ContextAI

Ozone is Chromium's platform abstraction layer for display and input, primarily used on Linux desktop and ChromeOS to interface with windowing systems such as Wayland and X11. CWE-416 (Use After Free) describes a class of memory safety defects where a program continues to reference memory after it has been freed, enabling an attacker to control the contents of that memory region and redirect execution or corrupt heap state. In Chromium's renderer and browser process architecture, UAF bugs in platform-level components like Ozone can cross process boundaries and undermine the sandbox. The affected version range is all Chrome releases prior to 149.0.7827.103, as confirmed by the EUVD entry (EUVD-2026-35228) and the vendor's stable channel update advisory.

RemediationAI

The primary remediation is to update Google Chrome to version 149.0.7827.103 or later, which includes the vendor-released fix for this use-after-free in Ozone. The stable channel update advisory is available at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html. For organizations unable to patch immediately, the most effective compensating control is enforcing strict physical access policies - device screen locks, full-disk encryption (to limit value of physical access), and unattended device policies reduce the viable attack window. On managed ChromeOS or Linux fleets, disabling local login or enforcing verified boot adds a layer of deterrence. Note that these physical controls do not eliminate the vulnerability; they raise the bar for exploitation. Patch deployment remains the only confirmed remediation.