Description
Use after free in Dawn in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Published: 2026-06-08
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A use‑after‑free flaw was discovered in the Dawn renderer component of Google Chrome on macOS. This weakness is identified as CWE‑416 (Use After Free) and is associated with memory corruption CWE‑825. The bug allows a remote attacker to potentially corrupt heap memory by providing a specially crafted HTML page. The Chromium severity rating is high, reflected in a CVSS score of 8.8. Based on the description, the potential impact could include a crash or other adverse result, but the specific outcome is not stated.

Affected Systems

The vulnerability affects Google Chrome on macOS for all versions prior to 149.0.7827.103. Any user employing those builds to view web content is potentially exposed.

Risk and Exploitability

The flaw requires a victim to open a malicious webpage in Chrome on a Mac. The EPSS score of < 1% indicates a very low exploitation probability, and the vulnerability is not listed in CISA's KEV catalog; the CVSS score of 8.8 indicates a high severity and potential for heap corruption, indicating a meaningful risk. Based on the description, an attacker could host and serve a crafted page; this inference suggests a standard web‑based delivery vector is probable.

Generated by OpenCVE AI on June 11, 2026 at 03:05 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Chrome on all macOS systems to version 149.0.7827.103 or later.
  • Deploy the new Chrome release through your organization’s patch management or mobile device management solution to ensure all users receive the fix.
  • If patch deployment cannot be performed immediately, use your group policy or MDM to disable or quarantine the affected Chrome installations on all machines until the fix is applied.

Generated by OpenCVE AI on June 11, 2026 at 03:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6337-1 chromium security update
History

Thu, 11 Jun 2026 00:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: Use after free in Dawn
Weaknesses CWE-825
References
Metrics threat_severity

None

 threat_severity

Important

Tue, 09 Jun 2026 15:00:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos

Tue, 09 Jun 2026 04:15:00 +0000

Type Values Removed Values Added
Title Use-After‑Free Exploit in Chrome Dawn Causes Heap Corruption on macOS

Tue, 09 Jun 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 09 Jun 2026 02:00:00 +0000

Type Values Removed Values Added
Title Use-After‑Free Exploit in Chrome Dawn Causes Heap Corruption on macOS

Tue, 09 Jun 2026 01:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Mon, 08 Jun 2026 23:45:00 +0000

Type Values Removed Values Added
Description Use after free in Dawn in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-416
References

Subscriptions

Apple Macos
Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-06-09T03:56:05.034Z

Reserved: 2026-06-08T21:33:53.434Z

Link: CVE-2026-11687

cve-icon Vulnrichment

Updated: 2026-06-09T01:22:09.853Z

cve-icon NVD

Status : Analyzed

Published: 2026-06-09T00:16:52.110

Modified: 2026-06-09T14:52:08.737

Link: CVE-2026-11687

cve-icon Redhat

Severity : Important

Publid Date: 2026-06-08T00:00:00Z

Links: CVE-2026-11687 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-06-11T03:15:04Z

Weaknesses