What is the CVSS score of EUVD-2026-35263?

EUVD-2026-35263 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by EUVD-2026-35263?

Google Chrome versions prior to 149.0.7827.103 contain a sandbox escape vulnerability that allows attackers with an already-compromised renderer process to achieve system-level code execution through…. A patch is available.

How to fix or mitigate EUVD-2026-35263?

Within 24 hours: Inventory Chrome deployments across endpoints and identify any instances running versions prior to 149.0.7827.103; alert IT security and system administrators of critical patch requirement. Within 7 days: Deploy Chrome 149.0.7827.103 or later via patch management system (Intune, Google Admin Console, or equivalent); verify automatic update policies are enabled. Within 30 days: Execute vulnerability scans to confirm patch deployment completeness and document remediation evidence for audit.

Google Chrome EUVD-2026-35263

| CVE-2026-11663 HIGH

Use After Free (CWE-416)

2026-06-09 chrome-cve-admin@google.com

GHSA-hc8r-4qxg-x57v

Denial Of Service Use After Free Memory Corruption Google

8.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 02:44 vuln.today

CVSS changed

Jun 09, 2026 - 02:22 NVD

8.3 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in Skia in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 149.0.7827.103 allows a remote attacker who has already compromised the renderer process to break out of the Chromium sandbox via a use-after-free in the Skia graphics library. The flaw is rated High severity by Chromium and carries a CVSS 8.3, but exploitation requires both a prior renderer compromise and user interaction with a crafted HTML page. No public exploit identified at time of analysis.

Technical ContextAI

The vulnerability resides in Skia, the 2D graphics rendering library used by Chrome (and many Chromium-derived browsers) to draw paths, text, and images. CWE-416 (Use After Free) means an object in Skia is freed while a dangling reference is still in scope; subsequent access to that memory allows an attacker to manipulate freed-then-reallocated heap chunks to corrupt control data. Because Skia code runs in a privileged GPU/browser process boundary (not solely the sandboxed renderer), a UAF here is a classic sandbox-escape primitive - it lets a compromised renderer reach across the IPC boundary and gain code execution in a less-restricted process.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.103 - update Chrome Stable to that version or later via the built-in updater or by redeploying managed packages, then restart the browser to load the patched Skia. Enterprise administrators should verify rollout via chrome://settings/help on a sample of endpoints and accelerate the auto-update channel where it has been pinned. Downstream Chromium-based browsers (Edge, Brave, Opera, Electron apps) should be upgraded once their vendors ship a build incorporating the Skia fix; track each vendor's release notes referenced from https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html and the Chromium issue at https://issues.chromium.org/issues/513820666. Until patched, the only meaningful compensating control is to restrict browsing to trusted sites via enterprise policy or site isolation enforcement and, on high-risk endpoints, disable hardware acceleration (Settings → System) to reduce some Skia GPU paths - note this degrades rendering performance and does not eliminate the CPU Skia code path, so it is not a substitute for patching.