What is the CVSS score of CVE-2026-11019?

CVE-2026-11019 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11019?

Yes, a patch is available for CVE-2026-11019. Update the affected software to the latest version immediately.

Google Chrome Android CVE-2026-11019

EUVD-2026-34468 MEDIUM

Authentication Bypass by Spoofing (CWE-290)

2026-06-04 chrome-cve-admin@google.com

GHSA-59pj-j88w-7p7w

Authentication Bypass Google

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Red Hat

5.6 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 17:31 vuln.today

CVSS changed

Jun 08, 2026 - 17:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Payments in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perform domain spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Domain spoofing in the Google Chrome Payments component on Android (versions prior to 149.0.7827.53) enables integrity manipulation of payment flows when an attacker has already compromised the renderer process. By serving a crafted HTML page, the attacker can make the Chrome Payments UI display a spoofed domain, potentially deceiving users into authorizing payments to attacker-controlled origins. EPSS stands at 0.03% (11th percentile), no public exploit code has been identified, and this CVE does not appear in the CISA KEV catalog.

Technical ContextAI

The vulnerability resides in the Payments component of Chromium's Android implementation (CWE-290: Authentication Bypass by Spoofing). Chrome's Payments API relies on origin/domain binding to establish trust between a payment request and the merchant domain - this binding prevents a compromised renderer from impersonating legitimate payment origins. The 'inappropriate implementation' indicates the domain validation logic fails to correctly enforce origin restrictions when the renderer has been compromised, allowing the spoofed origin to propagate into the payment UI. The affected CPE scope is Google Chrome on Android prior to version 149.0.7827.53, as confirmed by ENISA EUVD-2026-34468 and the Chromium issue tracker (issue 497344640).

RemediationAI

Update Google Chrome on Android to version 149.0.7827.53 or later, which contains the vendor-released patch for this issue. The fix is documented in the Chrome Stable Channel Update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. For organizations that cannot immediately deploy the update, a compensating control is to restrict or disable web-based payment flows on Android Chrome instances via enterprise mobile device management (MDM) policies - note this would disrupt legitimate payment UX. Because exploitation requires a prior renderer compromise, prioritizing patching of any concurrently reported Chrome renderer RCE vulnerabilities would also reduce the effective exploitability of this issue by eliminating the required precondition. No known workaround fully mitigates the spoofing behavior without upgrading.