What is the CVSS score of EUVD-2026-35273?

EUVD-2026-35273 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by EUVD-2026-35273?

Google Chrome versions prior to 149.0.7827.103 contain a remote code execution vulnerability in the InterestGroups component that allows arbitrary code execution through a crafted webpage with user…. A patch is available.

How to fix or mitigate EUVD-2026-35273?

Within 24 hours: Assess Chrome deployment footprint across the organization and prepare patch rollout plan prioritizing high-risk users (developers, finance, legal). Within 7 days: Complete deployment of Chrome 149.0.7827.103 or later to all organizational Chrome instances and verify rollout completion via patch management tools. Within 30 days: Audit compliance with Chrome version policy and establish automated update mechanisms to prevent future version gaps.

Google Chrome EUVD-2026-35273

| CVE-2026-11673 HIGH

Use After Free (CWE-416)

2026-06-09 chrome-cve-admin@google.com

GHSA-x6q3-gw4h-79f9

Google Memory Corruption RCE Use After Free Denial Of Service

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 02:43 vuln.today

CVSS changed

Jun 09, 2026 - 01:22 NVD

8.8 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in InterestGroups in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome versions prior to 149.0.7827.103 stems from a use-after-free flaw in the InterestGroups component, enabling a remote attacker to execute arbitrary code within the renderer sandbox via a crafted HTML page. The vulnerability carries a CVSS 8.8 (High) score and is rated High severity by Chromium, but no public exploit identified at time of analysis and SSVC indicates exploitation status of none. Attack requires user interaction (visiting a malicious page) but no authentication.

Technical ContextAI

The vulnerability resides in Chrome's InterestGroups implementation, which is part of the Protected Audience API (formerly FLEDGE) - a Privacy Sandbox component used for on-device ad auctions that replaces third-party cookie-based interest targeting. CWE-416 (Use After Free) describes a memory safety flaw where freed heap memory continues to be referenced; an attacker who can influence allocator state can cause the dangling pointer to reference attacker-controlled data, leading to control-flow hijack. The bug is reachable from web content because InterestGroups exposes JavaScript-accessible interfaces (navigator.joinAdInterestGroup, runAdAuction) that drive the underlying C++ object lifetimes in the browser/renderer process.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.103 - update via Chrome's auto-update mechanism or manually trigger an update through chrome://settings/help and restart the browser, as documented in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html. Enterprise administrators using managed deployments should ensure the auto-update policy is not disabled and push the build through their software distribution mechanism (Chrome Browser Cloud Management, SCCM, Jamf, etc.). As a compensating control until patching completes, the Protected Audience / InterestGroups surface can be disabled by setting the PrivacySandboxAdMeasurementEnabled and PrivacySandboxAdTopicsEnabled enterprise policies to false and disabling chrome://flags/#privacy-sandbox-ads-apis, which removes the vulnerable code path from JavaScript reachability at the cost of breaking sites that rely on Privacy Sandbox ad auctions; users of Chromium-derivative browsers should monitor their vendor's release notes for a rebase incorporating the fix.