What is the CVSS score of CVE-2026-11008?

CVE-2026-11008 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11008?

Yes, a patch is available for CVE-2026-11008. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11008

EUVD-2026-34457 MEDIUM

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-f22m-q7fc-qvp5

Information Disclosure Google

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Red Hat

6.8 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 17:30 vuln.today

CVSS changed

Jun 08, 2026 - 17:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in WebAppInstalls in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's WebAppInstalls component (versions prior to 149.0.7827.53) enables a remote attacker who has already compromised the renderer process to exfiltrate sensitive cross-origin data via a crafted HTML page. The CVSS 6.5 score captures the high confidentiality impact and network accessibility, but understates effective exploitation complexity because a prior renderer compromise is an explicit prerequisite. EPSS is very low at 0.04% (13th percentile), no public exploit code has been identified, and no CISA KEV listing exists at time of analysis, positioning this as a chained exploitation primitive rather than a standalone critical threat.

Technical ContextAI

The vulnerability resides in the WebAppInstalls subsystem of Google Chrome, which manages installation and lifecycle workflows for Progressive Web Apps (PWAs). The root cause is CWE-20 (Improper Input Validation): the component fails to adequately validate untrusted data originating from the renderer process, allowing attacker-controlled content to influence cross-origin data exposure. Because the attack originates from a compromised renderer, this flaw sits at the boundary between Chrome's renderer sandbox and its browser process, making it a sandbox-escape-adjacent information disclosure primitive. Affected versions are all Chrome releases prior to 149.0.7827.53 per EUVD-2026-34457. No CPE string was supplied in source data; Chromium-based derivatives may share exposure depending on their patch cadence.

RemediationAI

Update Google Chrome to version 149.0.7827.53 or later, as detailed in the official stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome's built-in auto-update should apply this fix automatically; users and administrators can verify or force the update via Chrome menu > Help > About Google Chrome. Since successful exploitation requires a prior renderer compromise, ensuring Chrome's sandbox is not disabled via enterprise Group Policy (RendererCodeIntegrityEnabled, SandboxExternalProtocolBlocked) significantly reduces attacker ability to chain this vulnerability - disabling the sandbox as a 'compatibility fix' should be avoided as it removes the primary barrier. No configuration-level workaround addresses the WebAppInstalls input validation flaw directly; patching is the only definitive remediation.