Why this deserves its current priority

A CVSS score is not reported in the current record. Known-exploitation status makes exposure review time-sensitive. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps Google/Chrome (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for Google/Chrome.
2. 2Review the reported fix. Update Google/Chrome to 149.0.7827.103 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

1. Published upstream

   Jun 8, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Jun 23, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Jun 9, 2026

4. Added to CISA KEV

   Jun 9, 2026

   Evidence: source:kev:kev:kev:record

Sources and claim methodology

• Source referencechromereleases.googleblog.com
• Source referenceissues.chromium.org
• CISA Known Exploited Vulnerabilities catalogcisa.gov

Related CVEs

• Medixant RadiAnt DICOM Out-of-bounds writeAlso CWE-787
• FFmpeg 0.5 < 9.0 DVB Subtitle Parser Heap Buffer Overflow via WTV FileAlso CWE-787
• FFmpeg 4.4 < 9.0 Heap Out-of-Bounds Write in CFHD Decoder via AVI DemuxingAlso CWE-787
• node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScriptAlso CWE-125
• Stream <= 4.2.0 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via Heartbeat APISame generic ecosystem
• Ultra Addons for Contact Form 7 <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider AttributesSame generic ecosystem

Why this deserves its current priority

A CVSS score is not reported in the current record. Known-exploitation status makes exposure review time-sensitive. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps Google/Chrome (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for Google/Chrome.
2. 2Review the reported fix. Update Google/Chrome to 149.0.7827.103 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

1. Published upstream

   Jun 8, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Jun 23, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Jun 9, 2026

4. Added to CISA KEV

   Jun 9, 2026

   Evidence: source:kev:kev:kev:record

Sources and claim methodology

• Source referencechromereleases.googleblog.com
• Source referenceissues.chromium.org
• CISA Known Exploited Vulnerabilities catalogcisa.gov

Related CVEs

• Medixant RadiAnt DICOM Out-of-bounds writeAlso CWE-787
• FFmpeg 0.5 < 9.0 DVB Subtitle Parser Heap Buffer Overflow via WTV FileAlso CWE-787
• FFmpeg 4.4 < 9.0 Heap Out-of-Bounds Write in CFHD Decoder via AVI DemuxingAlso CWE-787
• node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScriptAlso CWE-125
• Stream <= 4.2.0 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via Heartbeat APISame generic ecosystem
• Ultra Addons for Contact Form 7 <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider AttributesSame generic ecosystem