What is the CVSS score of EUVD-2026-35249?

EUVD-2026-35249 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by EUVD-2026-35249?

Google Chrome vulnerabilities affecting employee computers pose a direct risk to sensitive corporate data and system integrity.. A patch is available.

How to fix or mitigate EUVD-2026-35249?

Within 24 hours: Initiate communication to all Chrome users and enable automatic Chrome updates if not already configured. Within 7 days: Verify deployment of Chrome version 149.0.7827.103 or later across all organization devices through endpoint management tools or automatic update verification. Within 30 days: Conduct full compliance audit to confirm all Chrome instances meet version 149.0.7827.103 or later and establish processes for rapid deployment of critical security updates.

Google Chrome EUVD-2026-35249

| CVE-2026-11649 HIGH

Use After Free (CWE-416)

2026-06-09 chrome-cve-admin@google.com

GHSA-2hgr-cprg-9825

Google Memory Corruption RCE Use After Free Denial Of Service Red Hat Suse

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 02:47 vuln.today

CVSS changed

Jun 09, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome's V8 JavaScript engine prior to version 149.0.7827.103 allows attackers to execute arbitrary code within the renderer sandbox by luring a user to a crafted HTML page. The flaw is a use-after-free memory corruption issue rated High severity by Chromium, with a CVSS 8.8 score reflecting low attack complexity but requiring user interaction. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Attacker stages crafted HTML on attacker-controlled site

Delivery

Lures victim via phishing or malvertising

Exploit

Victim's Chrome loads page and executes JavaScript

Execution

V8 use-after-free triggered in renderer

Persist

Attacker gains arbitrary code execution in sandbox

Impact

Optional chain with sandbox escape for host compromise

Access

Attacker stages crafted HTML on attacker-controlled site

Delivery

Lures victim via phishing or malvertising

Exploit

Victim's Chrome loads page and executes JavaScript

Execution

V8 use-after-free triggered in renderer

Persist

Attacker gains arbitrary code execution in sandbox

Impact

Optional chain with sandbox escape for host compromise

Vulnerability AssessmentAI

Exploitation	Victim must open or be redirected to an attacker-controlled HTML page in a vulnerable Chrome build (<149.0.7827.103) with JavaScript enabled - the default configuration. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Signals are mixed but lean toward prioritized patching. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts or compromises a website containing a crafted HTML/JavaScript payload that triggers the use-after-free in V8's object lifetime handling. A victim browsing with a vulnerable Chrome build is sent to the page via phishing email, malvertising, or watering-hole compromise (UI:R - single click required), at which point JavaScript reclaims the freed memory and pivots to arbitrary code execution inside the renderer sandbox. …
Remediation	Vendor-released patch: Google Chrome 149.0.7827.103 or later on the Stable channel - update via Chrome's built-in updater (chrome://settings/help) or via managed deployment tools (Chrome Browser Cloud Management, Intune, JAMF, WSUS). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Initiate communication to all Chrome users and enable automatic Chrome updates if not already configured. …

Threat intelligence, references, and detailed analysis are available after sign-in.

Vendor StatusVendor

SUSE

Severity: Critical

Product	Status
openSUSE Leap 16.0	Fixed
openSUSE Tumbleweed	Fixed

EUVD-2026-35249 vulnerability details – vuln.today

Back

Google Chrome EUVD-2026-35249

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code