What is the CVSS score of CVE-2026-11013?

CVE-2026-11013 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11013?

Yes, a patch is available for CVE-2026-11013. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11013

EUVD-2026-34462 MEDIUM

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-hm5x-5c3q-w6ch

Information Disclosure Google Chrome Red Hat Suse

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Red Hat

5.7 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 18:31 vuln.today

CVSS changed

Jun 08, 2026 - 16:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Memory disclosure in Google Chrome's Network component (versions prior to 149.0.7827.53) allows an attacker who has already compromised the renderer process to read potentially sensitive data from process memory by delivering a crafted HTML page to the victim. This is a chained, two-stage attack: exploitation requires a prior renderer process compromise as an explicit prerequisite, which substantially elevates the real-world difficulty beyond what the CVSS 6.5 score alone implies. No active exploitation has been identified (SSVC Exploitation: none; EPSS: 0.05% at the 15th percentile), and no public exploit code exists at time of analysis.

Technical ContextAI

The vulnerability resides in Chromium's Network component, which processes network requests and responses within Chrome's multi-process, sandboxed architecture. CWE-20 (Improper Input Validation) identifies the root cause as a failure to adequately validate untrusted input originating from the network layer before operating on it in memory. In Chromium's process model, the renderer handles page rendering inside a sandbox while the Network Service process handles privileged network operations - insufficient validation at the boundary between these components is what enables memory disclosure when the renderer is already under attacker control. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome desktop versions prior to 149.0.7827.53 across platforms, as confirmed by EUVD-2026-34462.

RemediationAI

The primary remediation is to upgrade Google Chrome to version 149.0.7827.53 or later, which contains the vendor-released patch. The stable channel update announcement is at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Enterprise administrators should enforce the update via Chrome's managed browser policies (e.g., Google Admin Console or GPO-based update management). Because exploitation explicitly requires a prior renderer process compromise, organizations with endpoint detection and response (EDR) tools capable of detecting renderer sandbox escapes gain an additional defensive layer that would interrupt the attack chain before this vulnerability becomes relevant. Restricting users from visiting untrusted or unsolicited HTML pages via web proxy filtering also reduces exposure while patching is in progress. No workaround that eliminates the vulnerability without patching has been identified in available references.