What is the CVSS score of CVE-2026-11016?

CVE-2026-11016 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11016?

Yes, a patch is available for CVE-2026-11016. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11016

EUVD-2026-34465 MEDIUM

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-5c49-xx75-xq3h

Authentication Bypass Google Chrome Red Hat Suse

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Red Hat

8.7 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 16:23 vuln.today

CVSS changed

Jun 08, 2026 - 16:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Same origin policy bypass in Google Chrome's Network component (prior to 149.0.7827.53) enables an attacker who has already compromised the renderer process to exfiltrate or manipulate cross-origin data via a crafted HTML page. The integrity impact is rated High (I:H) with no confidentiality or availability impact, meaning the primary risk is unauthorized cross-origin writes or request forgery rather than data theft. No public exploit code has been identified at time of analysis, and EPSS sits at 0.02% (6th percentile), indicating low observed exploitation probability despite the medium CVSS score.

Technical ContextAI

The vulnerability resides in Chrome's Network component and is classified under CWE-20 (Improper Input Validation) - the browser fails to adequately validate untrusted input originating from a renderer process before acting on it at the network layer. The same origin policy (SOP) is a foundational browser security boundary preventing scripts from one origin from interacting with resources from another. A compromised renderer - Chrome's sandboxed content process - can exploit this validation gap to send malformed or crafted network requests that the browser's network stack incorrectly services without enforcing SOP checks. This is architecturally significant: Chrome's multi-process model is designed so that even a fully compromised renderer cannot cross process trust boundaries, making this a partial sandbox bypass at the network layer. Affected CPE: Google Chrome versions prior to 149.0.7827.53 on all supported desktop platforms.

RemediationAI

Update Google Chrome to version 149.0.7827.53 or later, which is the vendor-released patch confirmed via the Google Chrome Stable Channel Update advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html). Chrome's auto-update mechanism should deliver this update automatically; administrators managing enterprise fleets should verify deployment via Google Admin Console or Chrome Browser Cloud Management. For environments where immediate patching is not feasible, the most effective compensating control is to restrict users from visiting untrusted or external HTML pages and to enforce Chrome's Enhanced Protection mode in Safe Browsing settings, which may reduce renderer compromise risk from the prerequisite stage. Disabling JavaScript on untrusted sites via policy would also reduce the renderer attack surface, though with significant usability trade-offs. Since exploitation requires a prior renderer compromise, prioritizing defense against renderer exploits (e.g., enforcing process isolation policies, blocking known exploit delivery vectors) is a meaningful upstream mitigation.