Description
Use after free in Chromoting in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Low)
Published: 2026-06-04
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability is a use‑after‑free flaw located in the Chromoting component of Google Chrome on Linux. By delivering specially crafted network traffic, a remote attacker can cause the browser to execute arbitrary code. The issue is identified as a CWE‑416 and CWE‑825 weakness and is capable of compromising confidentiality, integrity, and availability of the affected system.

Affected Systems

Google Chrome running on Linux is affected. No specific version numbers are published in the advisory; users should consult Google’s release notes for a fix or confirm that their installation is on a version newer than 149.0.7827.53 when released.

Risk and Exploitability

The EPSS score is < 1%, and the CVSS score is 8.1. The vulnerability is not listed in the CISA KEV catalog. Because it permits remote code execution via network traffic, the risk is considered high for systems that expose Chromoting or receive untrusted data. Until an official patch is available, malicious actors can exploit the flaw when the affected component is reachable over the network.

Generated by OpenCVE AI on June 7, 2026 at 16:32 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install the latest Google Chrome update that contains the Chromoting fix once it is released
  • If no update is available, disable or restrict the Chromoting feature or block related network ports until a patch can be applied
  • Continuously monitor Google Chrome security advisories and apply updates promptly to mitigate this remote code execution risk

Generated by OpenCVE AI on June 7, 2026 at 16:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6325-1 chromium security update
History

Sun, 07 Jun 2026 12:15:00 +0000

Type Values Removed Values Added
Title Chromoting Use‑After‑Free Vulnerability Enables Remote Code Execution chromium-browser: Use after free in Chromoting
Weaknesses CWE-825
References
Metrics threat_severity

None

 threat_severity

Low

Fri, 05 Jun 2026 20:45:00 +0000

Type Values Removed Values Added
Title Chromoting Use‑After‑Free Vulnerability Enables Remote Code Execution
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel

Fri, 05 Jun 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Fri, 05 Jun 2026 15:45:00 +0000

Type Values Removed Values Added
Title Use-After-Free in Chrome Chromoting Enables Remote Code Execution on Linux

Fri, 05 Jun 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 05 Jun 2026 04:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Fri, 05 Jun 2026 04:00:00 +0000

Type Values Removed Values Added
Title Use-After-Free in Chrome Chromoting Enables Remote Code Execution on Linux

Thu, 04 Jun 2026 23:15:00 +0000

Type Values Removed Values Added
Description Use after free in Chromoting in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Low)
Weaknesses CWE-416
References

Subscriptions

Google Chrome
Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-06-06T03:56:10.824Z

Reserved: 2026-06-04T17:10:55.421Z

Link: CVE-2026-11224

cve-icon Vulnrichment

Updated: 2026-06-05T13:53:13.478Z

cve-icon NVD

Status : Analyzed

Published: 2026-06-04T23:17:30.150

Modified: 2026-06-05T20:43:12.827

Link: CVE-2026-11224

cve-icon Redhat

Severity : Low

Publid Date: 2026-06-02T00:00:00Z

Links: CVE-2026-11224 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-06-07T16:45:04Z

Weaknesses