What is the CVSS score of EUVD-2026-35243?

EUVD-2026-35243 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by EUVD-2026-35243?

Google Chrome contains a critical remote code execution vulnerability (CVE-2026-11643, CVSS 8.1) that poses significant risk to all unpatched endpoints in your organization.. A patch is available.

How to fix or mitigate EUVD-2026-35243?

Within 24 hours: Activate incident response procedures and conduct a complete inventory of Chrome deployments across all endpoints. Within 7 days: Deploy Chrome version 149.0.7827.103 or later via your patch management system, prioritizing internet-facing and critical systems. Within 30 days: Verify patch deployment across 100% of managed Chrome installations, remediate any unpatched instances, and report compliance status to executive leadership.

Google Chrome EUVD-2026-35243

| CVE-2026-11643 HIGH

Use After Free (CWE-416)

2026-06-09 chrome-cve-admin@google.com

GHSA-5qfq-3xhg-hc6j

Google Memory Corruption RCE Use After Free Denial Of Service

8.1

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 02:50 vuln.today

CVSS changed

Jun 09, 2026 - 01:22 NVD

8.1 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 8.1

DescriptionCVE.org

Use after free in Proxy in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Critical)

AnalysisAI

Remote code execution in Google Chrome versions prior to 149.0.7827.103 stems from a use-after-free condition in the Proxy component, enabling remote attackers to execute arbitrary code by delivering malicious network traffic. Chromium has rated this issue Critical severity, and while no public exploit is identified at the time of analysis, the network-reachable nature of the Proxy subsystem and Chrome's massive deployment footprint make this a high-priority browser patch. The CVSS 8.1 score reflects high attack complexity offset by no required privileges or user interaction.

Technical ContextAI

The vulnerability resides in Chrome's Proxy component, which handles proxy resolution, PAC (Proxy Auto-Config) script evaluation, and HTTP/HTTPS proxy connection management within the network service. CWE-416 (Use After Free) indicates that memory is referenced after it has been freed, typically because an object's lifetime is mismanaged across asynchronous network callbacks or reference-counted pointers. In a browser context, an attacker can manipulate heap layout via JavaScript or crafted network responses to control the contents of freed memory, then trigger the dangling pointer to achieve arbitrary read/write primitives and ultimately code execution within the renderer or network service process. Chromium's site isolation and sandbox mitigate post-exploitation impact, but a UAF in the network-facing Proxy layer is a well-known class of bug used in real-world Chrome exploit chains.

RemediationAI

Vendor-released patch: Chrome Stable 149.0.7827.103 - update Google Chrome to 149.0.7827.103 or later via the built-in updater (chrome://settings/help) or enterprise deployment tooling, and restart the browser to apply. Administrators of managed fleets should push the update through Group Policy, Jamf, Intune, or equivalent MDM and verify uptake via version telemetry. Downstream Chromium-based browsers (Edge, Brave, Opera, Vivaldi, Electron apps) should be updated as soon as their vendors ship the corresponding Chromium merge. Until patching is complete, compensating controls include disabling system or PAC-based proxy configurations on endpoints that traverse untrusted networks (trade-off: breaks proxy-dependent enterprise traffic routing and split-tunnel VPNs), enforcing trusted-network-only proxy use via network policy, and blocking outbound connections to unknown PAC URLs at the egress firewall. Reference the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html.