What is the CVSS score of CVE-2026-11011?

CVE-2026-11011 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-11011?

Google Chrome Password Manager (versions prior to 149.0.7827.53) contains a site isolation bypass that allows an attacker with an already-compromised renderer process to escape cross-origin…. A patch is available.

How to fix or mitigate CVE-2026-11011?

24 hours: Audit Chrome version distribution across endpoints; identify users running versions prior to 149.0.7827.53. 7 days: Deploy Chrome 149.0.7827.53 or later via enterprise policy (GPO / Jamf / equivalent); prioritize development and security teams with sensitive credential exposure. 30 days: Confirm 100% deployment completion and review browser crash/renderer-isolation logs for exploitation indicators.

Google Chrome CVE-2026-11011

EUVD-2026-34460 HIGH

Client-Side Enforcement of Server-Side Security (CWE-602)

2026-06-04 chrome-cve-admin@google.com

GHSA-8c6f-vx28-w3cj

Authentication Bypass Google

8.1

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Red Hat

6.8 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 17:24 vuln.today

CVSS changed

Jun 08, 2026 - 17:22 NVD

8.1 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.1

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Site isolation bypass in Google Chrome's Password Manager prior to version 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to escape cross-origin protections via a crafted HTML page. The flaw stems from insufficient policy enforcement (CWE-602) and chains with a prior renderer compromise, making it a post-exploitation primitive rather than a standalone entry point. EPSS is very low (0.02%, 4th percentile) and no public exploit identified at time of analysis, though Google rates the underlying Chromium severity as Medium.

Technical ContextAI

The vulnerability resides in Chrome's Password Manager component and relates to site isolation, the security architecture that places different origins into separate renderer processes so a compromised renderer cannot read another site's data. CWE-602 (Client-Side Enforcement of Server-Side Security) indicates that policy checks intended to gate cross-origin access to credential data were performed insufficiently, letting an attacker-controlled HTML page in a compromised renderer reach data belonging to other origins. The affected component is the Blink/Chromium Password Manager subsystem shipped in Chrome desktop builds before 149.0.7827.53.

RemediationAI

Update Chrome to vendor-released patch version 149.0.7827.53 or later on all desktop platforms, as announced in the Stable Channel update at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Enterprises managing Chrome via policy should force-update through the Google Update or Chrome Browser Cloud Management channels and verify version compliance. As a temporary compensating control until patches are deployed, organizations can disable the built-in Password Manager via the PasswordManagerEnabled policy (trade-off: users lose autofill and saved-password convenience and may resort to weaker storage), and should track Chromium-based browser vendors (Edge, Brave, Opera, Electron) for their corresponding rebases. Browser exploit-mitigation hygiene - keeping site isolation enabled and avoiding command-line flags like --disable-site-isolation-trials - remains essential since this bug is most useful when chained with a renderer RCE.