Description
Use after free in Payments in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Published: 2026-06-08
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This flaw is a use‑after‑free defect in the Payments component of Google Chrome that allows a crafted HTML page to corrupt heap memory. The resulting heap corruption can be leveraged by a remote attacker to execute arbitrary code or otherwise compromise the integrity of the browser process. The weakness is a classic use‑after‑free scenario (CWE‑416).

Affected Systems

Any device running Google Chrome before version 149.0.7827.103 is vulnerable. The issue appears in all platforms that ship the affected release.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity. Although no EPSS score is available, the Chromium team has rated the vulnerability as High and the risk surface is significant when an untrusted website can deliver a malicious HTML payload. An attacker could target a user browsing the web, and the threat model assumes the victim is running the unpatched browser. The absence of a KEV listing does not diminish the potential impact, and the flaw remains exploitable until an update is applied.

Generated by OpenCVE AI on June 9, 2026 at 13:29 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Google Chrome to version 149.0.7827.103 or newer
  • Enable automatic browser updates to receive future patches
  • Avoid loading or interacting with untrusted payment pages until a patch is applied

Generated by OpenCVE AI on June 9, 2026 at 13:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 09 Jun 2026 15:00:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows

Tue, 09 Jun 2026 13:45:00 +0000

Type Values Removed Values Added
Title Use After Free in Chrome Payments Leading to Heap Corruption

Tue, 09 Jun 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 09 Jun 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Tue, 09 Jun 2026 03:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 09 Jun 2026 01:45:00 +0000

Type Values Removed Values Added
Title Use After Free in Chrome Payments Leading to Heap Corruption

Mon, 08 Jun 2026 23:45:00 +0000

Type Values Removed Values Added
Description Use after free in Payments in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-416
References

Subscriptions

Apple Macos
Google Chrome
Linux Linux Kernel
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-06-10T03:58:07.018Z

Reserved: 2026-06-08T21:33:44.917Z

Link: CVE-2026-11664

cve-icon Vulnrichment

Updated: 2026-06-09T10:25:11.767Z

cve-icon NVD

Status : Analyzed

Published: 2026-06-09T00:16:49.513

Modified: 2026-06-09T14:58:46.347

Link: CVE-2026-11664

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-09T13:30:04Z

Weaknesses