What is the CVSS score of EUVD-2026-35235?

EUVD-2026-35235 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by EUVD-2026-35235?

Google Chrome on macOS versions prior to 149.0.7827.103 contain a sandbox escape vulnerability (CVE-2026-11635, CVSS 8.3) that enables full system compromise once malicious content reaches the…. A patch is available.

How to fix or mitigate EUVD-2026-35235?

Within 24 hours: Identify all macOS endpoints running Chrome pre-149.0.7827.103; notify users and prepare push deployment. Within 7 days: Deploy Chrome 149.0.7827.103 or later to all macOS Chrome users via automatic update mechanism or managed distribution. Within 30 days: Audit Chrome inventory to verify patch application across all macOS fleet and document remediation completion.

Google Chrome EUVD-2026-35235

| CVE-2026-11635 HIGH

Use After Free (CWE-416)

2026-06-09 chrome-cve-admin@google.com

GHSA-qfhp-x82v-ppcm

Denial Of Service Use After Free Memory Corruption Google

8.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 02:54 vuln.today

CVSS changed

Jun 09, 2026 - 02:22 NVD

8.3 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome on macOS prior to 149.0.7827.103 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a use-after-free flaw in the Bluetooth component, triggered by a crafted HTML page. Chromium rates the severity as Critical, and a vendor patch is available; no public exploit has been identified at time of analysis, though the bug is tracked in the Chromium issue tracker (516987814).

Technical ContextAI

The vulnerability resides in Chrome's Bluetooth implementation, which exposes the Web Bluetooth API to renderer processes and brokers privileged operations through higher-privilege browser-process code on macOS. The root cause is CWE-416 (Use-After-Free): an object backing a Bluetooth operation is freed while a dangling reference remains reachable, allowing the attacker to reclaim the freed memory with controlled data and hijack subsequent operations. Because Bluetooth IPC crosses the renderer/browser-process boundary on macOS, corrupting state here lets an already-compromised renderer escape the Chrome sandbox into the more privileged browser process context.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.103 for macOS - upgrade immediately via Chrome's built-in updater or by redeploying the managed package, then ensure end users restart the browser so the update actually takes effect (Chrome staying open indefinitely is a common reason patches don't land). The Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html is the authoritative source. If patching cannot happen immediately, a targeted compensating control is to disable the Web Bluetooth API via the DefaultWebBluetoothGuardSetting enterprise policy set to 2 (block), which removes the attack surface for this specific bug at the cost of breaking any internal web apps that rely on Web Bluetooth; site isolation should also be confirmed enabled (it is by default) to raise the cost of the prerequisite renderer compromise. Users of Chromium-based browsers should monitor their respective vendor advisories for the merged upstream fix.