Description
Use after free in TabStrip in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
Published: 2026-06-08
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A use‑after‑free flaw in Chrome’s TabStrip component can trigger arbitrary code execution when a user loads a crafted web page and performs specific UI gestures. The vulnerability is classified as critical.

Affected Systems

Google Chrome versions earlier than 149.0.7827.103 on desktop environments are impacted.

Risk and Exploitability

The vulnerability does not appear in the KEV catalog and has an EPSS score of < 1%, indicating a very low probability of exploitation. The CVSS score of 7.5 indicates high severity. Exploitation requires an attacker to convince a user to visit a crafted web page and perform specific UI interactions, indicating a social‑engineering component. Once triggered, the exploit would allow attacker control over the affected process and potentially unauthorized code execution on the user’s machine.

Generated by OpenCVE AI on June 11, 2026 at 02:00 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 149.0.7827.103 or later, as released in the stable channel update
  • Enable Chrome’s auto‑update feature or manually install the latest Chromium build
  • Train users to avoid clicking unknown links or visiting untrusted sites that might host malicious pages

Generated by OpenCVE AI on June 11, 2026 at 02:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6337-1 chromium security update
History

Thu, 11 Jun 2026 00:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: Use after free in TabStrip
Weaknesses CWE-825
References
Metrics threat_severity

None

 threat_severity

Important

Tue, 09 Jun 2026 17:00:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows

Tue, 09 Jun 2026 03:15:00 +0000

Type Values Removed Values Added
Title Critical Use-After-Free Allowing Remote Code Execution in Chrome TabStrip

Tue, 09 Jun 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 09 Jun 2026 01:30:00 +0000

Type Values Removed Values Added
Title Critical Use-After-Free Allowing Remote Code Execution in Chrome TabStrip
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Tue, 09 Jun 2026 01:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Mon, 08 Jun 2026 23:45:00 +0000

Type Values Removed Values Added
Description Use after free in TabStrip in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
Weaknesses CWE-416
References

Subscriptions

Apple Macos
Google Chrome
Linux Linux Kernel
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-06-09T03:55:56.038Z

Reserved: 2026-06-08T21:33:33.073Z

Link: CVE-2026-11632

cve-icon Vulnrichment

Updated: 2026-06-09T01:11:36.362Z

cve-icon NVD

Status : Analyzed

Published: 2026-06-09T00:16:45.740

Modified: 2026-06-09T16:58:42.423

Link: CVE-2026-11632

cve-icon Redhat

Severity : Important

Publid Date: 2026-06-08T00:00:00Z

Links: CVE-2026-11632 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-06-11T02:15:27Z

Weaknesses