What is the CVSS score of EUVD-2026-35239?

EUVD-2026-35239 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by EUVD-2026-35239?

Google Chrome on macOS versions prior to 149.0.7827.103 contains a remote code execution vulnerability that allows attackers to compromise user systems through malicious webpages.. A patch is available.

How to fix or mitigate EUVD-2026-35239?

Within 24 hours: Issue security notice to all macOS users; ensure patch download is available and prepare distribution mechanisms (automatic updates, MDM, etc.). Within 7 days: Deploy Chrome version 149.0.7827.103 or later to all macOS systems through primary update channel. Within 30 days: Confirm 100% patch adoption across macOS Chrome installations; document completion for compliance and incident prevention records.

Google Chrome EUVD-2026-35239

| CVE-2026-11639 HIGH

Use After Free (CWE-416)

2026-06-09 chrome-cve-admin@google.com

GHSA-gxhq-jrg2-rq4q

Google Memory Corruption RCE Use After Free Denial Of Service

7.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 02:52 vuln.today

CVSS changed

Jun 09, 2026 - 01:22 NVD

7.5 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 7.5

DescriptionCVE.org

Use after free in Compositing in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Remote code execution in Google Chrome on macOS prior to version 149.0.7827.103 allows a remote attacker to exploit a use-after-free flaw in the Compositing component via a crafted HTML page. Google has rated the underlying Chromium security severity as Critical, and no public exploit identified at time of analysis, though the bug is patched in the latest stable channel. Successful exploitation requires user interaction (visiting a malicious page) and high attack complexity, which moderates real-world risk despite the high impact.

Technical ContextAI

The flaw resides in Chrome's Compositing subsystem, which is part of the Blink/Chromium rendering pipeline responsible for layering and painting GPU-accelerated content to the screen. CWE-416 (Use After Free) means an object in the compositor is referenced after its memory has been freed, allowing an attacker who controls the freed memory's contents to influence subsequent reads or function pointer dereferences and achieve memory corruption. Chromium's compositor runs inside the renderer process, so successful exploitation initially yields code execution within the renderer sandbox; combined with a sandbox escape it can lead to full system compromise. The vulnerability is specific to the macOS build of Chrome as called out in the description, despite Compositing being a cross-platform component.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.103 for macOS - upgrade immediately via Chrome's built-in auto-update or by relaunching the browser, and verify the version under chrome://settings/help, per the Stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html. In enterprise environments, push the patched build through your management tooling (Jamf, Intune, MDM) and confirm Chrome auto-update policies are not disabled. Until patching is complete, compensating controls include restricting browsing to trusted sites via web proxy or DNS filtering and enabling Site Isolation (which is on by default in modern Chrome) so a renderer compromise is less likely to expose cross-origin data; note these do not block exploitation of an attacker-controlled page the user visits. Chromium-based browsers downstream of this release (Edge, Brave, Opera, Vivaldi) should also be checked once their vendors ship the corresponding merge.