What is the CVSS score of CVE-2026-11014?

CVE-2026-11014 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11014?

Yes, a patch is available for CVE-2026-11014. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11014

EUVD-2026-34463 MEDIUM

Client-Side Enforcement of Server-Side Security (CWE-602)

2026-06-04 chrome-cve-admin@google.com

GHSA-f2q9-mqhp-gcp4

Authentication Bypass Google

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Red Hat

7.2 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 17:30 vuln.today

CVSS changed

Jun 08, 2026 - 17:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to bypass site isolation via a crafted Chrome Extension. (Chromium security severity: Medium)

AnalysisAI

Site isolation bypass in Google Chrome prior to version 149.0.7827.53 enables an attacker to circumvent Chrome's site isolation security boundary through a crafted malicious extension, resulting in high integrity impact (I:H per CVSS). The attack is gated by user interaction - specifically, the victim must be convinced to install the malicious extension - after which the extension exploits insufficient policy enforcement in Chrome's Extensions subsystem to cross site isolation boundaries without authorization. No public exploit has been identified at time of analysis, and the EPSS score of 0.01% (1st percentile) indicates negligible current exploitation interest.

Technical ContextAI

The vulnerability resides in Chrome's Extensions policy enforcement subsystem and is classified under CWE-602 (Client-Side Enforcement of Server-Side Security), meaning that security controls governing cross-origin operations are enforced in a way that client-side extension code can circumvent. Chrome's site isolation mechanism separates different web origins into distinct renderer processes as a defense-in-depth control - particularly critical post-Spectre - to prevent unauthorized cross-site data access. The Extensions API exposes a policy layer that governs what cross-origin operations extensions may perform; this policy layer is insufficiently enforced, allowing a crafted extension to bypass site isolation. Per EUVD-2026-34463, all Chrome desktop versions in the range below 149.0.7827.53 are affected. No independent CPE string was confirmed from NVD data in this advisory.

RemediationAI

The primary fix is to update Google Chrome to version 149.0.7827.53 or later, released by Google as part of the stable channel desktop update detailed at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. The vendor-released patch is confirmed available. As a compensating control prior to patching, enterprise administrators can enforce strict extension installation policies using Chrome's ExtensionInstallBlocklist and ExtensionInstallAllowlist group policy settings to permit only reviewed and approved extensions - note this requires enterprise management infrastructure (e.g., Active Directory GPO or Google Admin Console) and may disrupt workflows dependent on unapproved extensions. End users should be advised against installing extensions prompted by unsolicited web pages or phishing campaigns. Disabling Chrome's developer mode where not required reduces the risk of sideloaded extension installation by non-technical users.