Description
Use after free in Dawn in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Published: 2026-06-08
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A use‑after‑free flaw was discovered in the Dawn renderer component of Google Chrome on macOS. The bug allows a remote attacker to potentially corrupt heap memory by providing a specially crafted HTML page. The Chromium severity rating is high, reflected in a CVSS score of 8.8. Based on the description, the potential impact could include a crash or other adverse result, but the specific outcome is not stated.

Affected Systems

The vulnerability affects Google Chrome on macOS for all versions prior to 149.0.7827.103. Any user employing those builds to view web content is potentially exposed.

Risk and Exploitability

The flaw requires a victim to open a malicious webpage in Chrome on a Mac. While no EPSS score is available and the vulnerability is not listed in CISA's KEV catalog, the CVSS score of 8.8 indicates a high severity and potential for heap corruption, indicating a meaningful risk. Based on the description, an attacker could host and serve a crafted page; this inference suggests a standard web‑based delivery vector is probable.

Generated by OpenCVE AI on June 9, 2026 at 03:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Chrome on all macOS systems to version 149.0.7827.103 or later.
  • Deploy the new Chrome release through your organization’s patch management or mobile device management solution to ensure all users receive the fix.
  • If patch deployment cannot be performed immediately, use your group policy or MDM to disable or quarantine the affected Chrome installations on all machines until the fix is applied.

Generated by OpenCVE AI on June 9, 2026 at 03:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 09 Jun 2026 15:00:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos

Tue, 09 Jun 2026 04:15:00 +0000

Type Values Removed Values Added
Title Use-After‑Free Exploit in Chrome Dawn Causes Heap Corruption on macOS

Tue, 09 Jun 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 09 Jun 2026 02:00:00 +0000

Type Values Removed Values Added
Title Use-After‑Free Exploit in Chrome Dawn Causes Heap Corruption on macOS

Tue, 09 Jun 2026 01:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Mon, 08 Jun 2026 23:45:00 +0000

Type Values Removed Values Added
Description Use after free in Dawn in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-416
References

Subscriptions

Apple Macos
Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-06-09T03:56:05.034Z

Reserved: 2026-06-08T21:33:53.434Z

Link: CVE-2026-11687

cve-icon Vulnrichment

Updated: 2026-06-09T01:22:09.853Z

cve-icon NVD

Status : Analyzed

Published: 2026-06-09T00:16:52.110

Modified: 2026-06-09T14:52:08.737

Link: CVE-2026-11687

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-09T04:00:14Z

Weaknesses