EUVD-2026-35237
GHSA-7x6f-897q-8h7j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconAttacker stages crafted HTML page
-
DeliveryLures macOS Chrome user to visit URL
-
ExploitPage triggers Views UAF
-
InstallHeap groomed and dangling pointer hijacked
-
C2Arbitrary code executes in renderer
-
ExecuteOptional sandbox-escape chain
-
ImpactHost compromise on macOS endpoint
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Victim must run Google Chrome on macOS at a version below 149.0.7827.103 and visit attacker-controlled or attacker-influenced HTML (CVSS UI:R confirms user interaction is required - no zero-click vector). No authentication to the browser or the target site is needed (PR:N), attack complexity is low (AC:L), and the vector is network-reachable (AV:N) since any rendered web page qualifies. Limiting factors: the bug as described is macOS-only, so Windows and Linux Chrome users are out of scope; exploitation yields code execution inside the renderer sandbox, so a separate sandbox-escape primitive is required to reach the host OS; and Site Isolation plus the standard renderer sandbox raise the bar for end-to-end compromise. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) shows network-reachable, low-complexity, unauthenticated exploitation gated only by user interaction - consistent with a drive-by browser bug. Google's internal Chromium severity rating of Critical and the memory-corruption class (use-after-free in UI code, historically a productive sink for Chrome 1-days) elevate practical risk above the raw 8.8 score. However, this CVE is not listed in CISA KEV, no public exploit is identified at time of analysis, and no EPSS score was provided in the input, so the signal set lacks confirmation of in-the-wild use. Browser UAFs of this profile are frequently chained with a sandbox escape to achieve full compromise, so defenders should treat patching as urgent even absent active-exploitation telemetry; the macOS-only scope narrows the affected fleet versus a cross-platform Chrome bug. |
| Exploit ScenarioDerived | An attacker hosts a malicious HTML page - directly, through a compromised ad network, or via a phishing link - that drives the Views UI into the vulnerable allocation/free sequence (for example by manipulating dialogs, focus, or widget lifecycle from script). When a macOS user on a pre-149.0.7827.103 Chrome build loads the page, the use-after-free triggers, and a chained heap-grooming payload achieves arbitrary code execution in the renderer process. No public exploit is identified at time of analysis, but historically Chromium UAFs of this class have been weaponized within days of disclosure and paired with a sandbox escape for full host compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Remote code execution in Google Chrome on macOS prior to version 149.0.7827.103 stems from a use-after-free flaw in the Views UI component, enabling a remote attacker to run arbitrary code when a victim visits a crafted HTML page. Google rates the underlying Chromium severity as Critical, and a vendor patch is available; no public exploit identified at time of analysis. The CVSS 8.8 score reflects network-reachable exploitation with low complexity but requiring user interaction (visiting the malicious page).
RemediationAI
Vendor-released patch: Google Chrome 149.0.7827.103 for macOS - upgrade immediately via the built-in updater (chrome://settings/help) or by redeploying the latest stable MSI/PKG through your management tooling, then force-restart browser processes so the new binary loads. The fix is documented in the Chrome Releases stable channel update at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html. Until the patch is deployed, compensating controls include enforcing Site Isolation (already default in Chrome) to keep renderer compromises contained, blocking untrusted browsing through enterprise web-filtering or a secure web gateway (trade-off: breaks ad-hoc browsing), and restricting Chrome on macOS endpoints via MDM until the update is applied (trade-off: user-productivity impact). Downstream Chromium browsers should be tracked for their corresponding rebases - do not assume Edge, Brave, or Opera are patched until each vendor publishes a corresponding release note.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Chrome's Views framework, the cross-platform C++ UI toolkit Chromium uses to build browser windows, menus, dialogs, and other widget hierarchies on desktop platforms. CWE-416 (Use After Free) indicates that an object in the Views subsystem is dereferenced after its memory has been freed, typically because lifetime management between event handlers, animations, or focus tracking is mishandled. An attacker who can influence the sequence of UI events from a rendered page can groom the freed allocation and pivot the dangling pointer into arbitrary code execution within the affected process. The bug is scoped to the macOS build of Chrome per the description, suggesting the regression lies in platform-specific Views integration with AppKit.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Views in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
Executive ViewAI
Google Chrome on macOS versions prior to 149.0.7827.103 contain a critical remote code execution vulnerability (CVE-2026-11637) that allows attackers to compromise employee devices through malicious webpages. Successful exploitation could grant attackers complete control over affected systems, enabling unauthorized access to corporate data, credentials, and sensitive business information. All macOS users require immediate patching to eliminate this attack vector.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Use-After-Free and Memory Safety Flaws
View all 74Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Exploit-DB