What is the CVSS score of CVE-2026-11007?

CVE-2026-11007 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11007?

Yes, a patch is available for CVE-2026-11007. Update the affected software to the latest version immediately.

Chrome WebView Android CVE-2026-11007

EUVD-2026-34456 MEDIUM

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-cpq3-m8p9-h9p9

Information Disclosure Google

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Red Hat

6.8 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 17:29 vuln.today

CVSS changed

Jun 08, 2026 - 17:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's WebView component on Android exposes sensitive information to attackers who have already achieved renderer process compromise. Affected versions are all Chrome for Android releases prior to 149.0.7827.53. A remote attacker, operating from a compromised renderer context, can exfiltrate cross-origin data by delivering a specially crafted HTML page to the victim, bypassing same-origin policy protections. No public exploit code exists and EPSS stands at 0.04% (13th percentile), indicating low observed exploitation pressure at time of analysis; however, the high confidentiality impact (C:H) makes this a meaningful second-stage primitive in multi-vulnerability attack chains.

Technical ContextAI

The root cause is CWE-20 (Improper Input Validation) within the WebView subsystem of Google Chrome on Android. WebView is the Android platform component that renders web content inside native applications; it is used pervasively across third-party Android apps and the Chrome browser itself. Insufficient validation of untrusted input in this context allows a renderer-controlled document to read data from cross-origin frames or resources, violating the same-origin policy (SOP). The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects a network-reachable, low-complexity exploitation path requiring user interaction but no elevated privileges at the network perimeter level. Affected CPE is implicitly Google Chrome for Android prior to version 149.0.7827.53, per EUVD-2026-34456 and the Chromium issue tracker reference (issues.chromium.org/issues/495834228).

RemediationAI

The vendor-released patch is Chrome for Android version 149.0.7827.53, confirmed via the Google Chrome Stable Channel Update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Users and administrators should update Chrome for Android to 149.0.7827.53 or later immediately through the Google Play Store. For Android applications embedding WebView, app developers should ensure they are using the updated WebView provider (Android System WebView 149.0.7827.53+), which is distributed separately via the Play Store and can be updated independently of Chrome. If immediate patching is not feasible, the primary compensating control is restricting access to untrusted web content within WebView-based applications; however, this is application-specific and carries trade-offs in functionality. There are no generic network-layer mitigations applicable to this client-side browser vulnerability.