What is the CVSS score of EUVD-2026-35257?

EUVD-2026-35257 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by EUVD-2026-35257?

A remote code execution vulnerability in Google Chrome on macOS (versions prior to 149.0.7827.103) allows attackers to compromise affected systems through malicious web content, with no public…. A patch is available.

How to fix or mitigate EUVD-2026-35257?

Within 24 hours: Identify all macOS systems running Chrome prior to version 149.0.7827.103; assess deployment infrastructure and communication plans. Within 7 days: Deploy Chrome 149.0.7827.103 or later to all affected macOS endpoints via MDM, managed deployment, or auto-update mechanisms; verify deployment success. Within 30 days: Audit all systems for patch compliance; establish threat detection for exploitation attempts; document remediation evidence and track update metrics.

Google Chrome EUVD-2026-35257

| CVE-2026-11657 HIGH

Use After Free (CWE-416)

2026-06-09 chrome-cve-admin@google.com

GHSA-8cpx-r29v-jx66

Google Memory Corruption RCE Use After Free Denial Of Service

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 02:45 vuln.today

CVSS changed

Jun 09, 2026 - 01:22 NVD

8.8 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Payments in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome on macOS prior to version 149.0.7827.103 stems from a use-after-free flaw in the Payments component, allowing a remote attacker to run arbitrary code in the renderer process via a crafted HTML page. The issue carries a CVSS 8.8 (High) rating and was reported through Google's internal Chrome security process; no public exploit identified at time of analysis. Exploitation requires the victim to load attacker-controlled web content (UI:R), but no authentication or special privileges are needed.

Technical ContextAI

The vulnerability is a CWE-416 (Use-After-Free) memory corruption bug in Chrome's Payments subsystem, which implements the Payment Request API and related autofill/payments handlers in the renderer. Use-after-free bugs occur when memory is referenced after being freed, allowing an attacker who can control heap layout and reallocation to overwrite freed object fields (such as vtable pointers) and hijack control flow. Chrome's Payments code interacts with web-facing JavaScript APIs, making the freed object reachable from a malicious page; successful exploitation typically yields code execution within the sandboxed renderer, which in a full chain would then be paired with a sandbox escape. The macOS-specific scoping in the description suggests the bug manifests due to platform-specific object lifetime or threading behavior in the Mac build of Chrome 149.x.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.103 for macOS - upgrade immediately via Chrome's built-in updater or by redeploying the latest stable channel build, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html. Enterprises managing Chrome via MDM (Jamf, Intune, Kandji) should push the update and verify version compliance across the macOS fleet. Until patching is complete, compensating controls include enabling Site Isolation (default in modern Chrome) to limit cross-origin renderer reuse, restricting access to untrusted sites via enterprise web filtering or SafeBrowsing Enhanced Protection, and disabling the Payment Request API via the PaymentMethodPrivacySensitiveAPIsEnabled or similar enterprise policy if available - the trade-off is that web-based checkout flows using the Payment Request API will break for users. Browser-restart enforcement after update is recommended since Chrome updates do not take effect until the process is restarted.