What is the CVSS score of EUVD-2026-35231?

EUVD-2026-35231 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by EUVD-2026-35231?

Google Chrome on Windows versions prior to 149.0.7827.103 contain a critical vulnerability that allows attackers to bypass browser security protections and gain direct access to underlying system…. A patch is available.

How to fix or mitigate EUVD-2026-35231?

Within 24 hours: Identify all Windows systems running Chrome versions prior to 149.0.7827.103 using asset inventory or endpoint detection tools. Within 7 days: Deploy Chrome version 149.0.7827.103 or later organization-wide through standard patch management processes. Within 30 days: Verify 100% deployment completion and validate patch installation across all Windows systems.

Google Chrome EUVD-2026-35231

| CVE-2026-11631 HIGH

Use After Free (CWE-416)

2026-06-09 chrome-cve-admin@google.com

GHSA-xhf8-jxcw-9cvj

Google Memory Corruption Use After Free Microsoft Denial Of Service

8.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.9 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 11:23 vuln.today

CVSS changed

Jun 09, 2026 - 11:22 NVD

8.3 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in Aura in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome on Windows versions prior to 149.0.7827.103 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page exploiting a use-after-free in the Aura UI framework. Google rates the underlying Chromium issue as Critical severity, though exploitation requires a prior renderer compromise and user interaction (visiting a malicious page). No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV.

Technical ContextAI

Aura is Chromium's cross-platform UI abstraction layer responsible for window, input, and event management on Windows, Linux, and Chrome OS, and runs in the privileged browser process outside the renderer sandbox. The flaw is a CWE-416 Use-After-Free, a class of memory corruption in which freed heap memory is later referenced, allowing an attacker who can shape the freed object's replacement to hijack control flow or corrupt critical state. Because Aura executes in the browser process, a UAF triggered there from a compromised renderer is a prime sandbox-escape primitive - the renderer sends crafted IPC/UI events that cause the browser process to dereference a dangling pointer. The affected component is identified in the Chromium issue tracker (issues.chromium.org/issues/516691130) and fixed in the Windows Stable channel build 149.0.7827.103.

RemediationAI

Update Google Chrome on Windows to the vendor-released patch version 149.0.7827.103 or later via the Stable channel (advisory: https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html); Chrome's auto-updater will deliver this on next browser restart, so enterprise admins should force a relaunch rather than rely on user behavior. For Chromium-based downstream browsers, install the corresponding rebased build as soon as the vendor publishes it. Until patching is complete, compensating controls are limited because the bug is in core UI code reachable from any web page: enforce site isolation (enabled by default and should not be disabled), deploy Chrome's enterprise policy SitePerProcess and require the Enhanced Safe Browsing setting to reduce renderer-compromise odds, and consider network-level blocking of high-risk untrusted content categories for sensitive user populations - none of these prevent the Aura UAF itself but they raise the cost of obtaining the prerequisite renderer RCE. Disabling JavaScript in untrusted contexts via enterprise policy is the most effective workaround but breaks most modern web applications.