What is the CVSS score of EUVD-2026-35250?

EUVD-2026-35250 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by EUVD-2026-35250?

Google Chrome contains a remote code execution vulnerability in its V8 JavaScript engine (CVSS 8.8) that allows attackers to compromise user systems through a malicious webpage.. A patch is available.

How to fix or mitigate EUVD-2026-35250?

Within 24 hours: Issue mandatory browser update alert to all Chrome users; assess deployment infrastructure and mobile device coverage. Within 7 days: Complete deployment of Chrome 149.0.7827.103 or later across all organization systems; verify deployment with endpoint management tools and monitor user compliance. Within 30 days: Audit systems that could not be updated within 7 days, document any remediation plans, and review Chrome usage logs for suspicious activity.

Google Chrome EUVD-2026-35250

| CVE-2026-11650 HIGH

Use After Free (CWE-416)

2026-06-09 chrome-cve-admin@google.com

GHSA-35m9-r2q7-2ggv

Google Memory Corruption RCE Use After Free Denial Of Service

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 02:47 vuln.today

CVSS changed

Jun 09, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome's V8 JavaScript engine prior to version 149.0.7827.103 allows a remote attacker to execute arbitrary code within the renderer sandbox by enticing a user to visit a crafted HTML page. The flaw is a use-after-free memory corruption issue rated High severity by Chromium and carries a CVSS 8.8 score; no public exploit identified at time of analysis, but V8 UAF bugs are historically high-value targets for exploit chains.

Technical ContextAI

V8 is the open-source JavaScript and WebAssembly engine that powers Chrome, Edge, and other Chromium-derived browsers. The root cause is CWE-416 (Use After Free), where memory referenced by a pointer is freed but the pointer remains accessible, allowing later operations to read or write into reallocated memory. In V8, such bugs typically arise from incorrect lifetime tracking in the JIT compiler (TurboFan/Maglev), garbage collector interactions, or object handle management, and they are commonly turned into type confusion primitives that lead to arbitrary read/write inside the renderer process. Per the CPE-equivalent data from EUVD, exploitation is confined to Chrome builds below 149.0.7827.103 across the desktop stable channel.

RemediationAI

Vendor-released patch: update Google Chrome to 149.0.7827.103 or later via the stable channel auto-updater, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html, and restart the browser to ensure the new V8 binary is loaded. In enterprise environments, push the update through the Chrome Enterprise MSI/PKG bundles or your endpoint management tool and verify chrome://settings/help shows the fixed build. Until rollout completes, viable compensating controls include enforcing Chrome's Site Isolation (already on by default - confirm it is not disabled by policy), enabling the V8 sandbox / V8 memory cage where supported, deploying script-blocking or strict CSP at the proxy for high-risk users, and routing high-value users through a remote browser isolation service; note these reduce attack surface but break some web features (Site Isolation increases memory use; script blocking breaks many SPAs; RBI adds latency and cost).