What is the CVSS score of CVE-2026-11020?

CVE-2026-11020 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11020?

Yes, a patch is available for CVE-2026-11020. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11020

EUVD-2026-34469 MEDIUM

Origin Validation Error (CWE-346)

2026-06-04 chrome-cve-admin@google.com

GHSA-hjpv-wxpg-mvhc

Information Disclosure Google

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Red Hat

7.4 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 15:40 vuln.today

CVSS changed

Jun 08, 2026 - 15:37 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted XML file. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data disclosure in Google Chrome's Extensions component (versions prior to 149.0.7827.53) enables a remote attacker to read sensitive data belonging to other origins by delivering a crafted XML file to a victim. The CVSS vector confirms network-reachable, unauthenticated access (AV:N/PR:N) with High confidentiality impact, though user interaction is required (UI:R). No public exploit has been identified at time of analysis and EPSS probability sits at a low 0.03% (11th percentile), indicating limited exploitation likelihood despite the meaningful confidentiality impact.

Technical ContextAI

The root cause is CWE-346 (Origin Validation Error) - a class of flaws where a browser component fails to correctly enforce same-origin policy boundaries. Here, the Extensions subsystem in Chromium improperly processes or exposes data from a crafted XML file without adequate origin checking, permitting cross-origin reads that the browser's security model is designed to prevent. Affected product per EUVD-2026-34469: Google Chrome (desktop, stable channel) all versions in the range < 149.0.7827.53. The Chromium issue tracker entry (issues.chromium.org/issues/497440270) likely holds further technical detail, though public visibility of that ticket is not confirmed. The flaw is classified as 'Inappropriate implementation' - Chromium's internal severity taxonomy for logic or policy violations rather than memory-safety bugs - and was rated Medium by the Chromium security team, consistent with the 6.5 CVSS base score.

RemediationAI

The primary remediation is to update Google Chrome to version 149.0.7827.53 or later, which is the vendor-confirmed fixed release per the stable channel update advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Most consumer Chrome installs will update automatically, but enterprise administrators should validate rollout across managed fleets using Chrome Browser Cloud Management or equivalent policy tooling and confirm the installed version matches or exceeds 149.0.7827.53. As a compensating control during the patching window, administrators can restrict or disable Chrome extensions at the enterprise level via Chrome ExtensionInstallBlocklist or ForceInstallList policies - this directly reduces the attack surface in the vulnerable Extensions component, though it may break workflows dependent on browser extensions and requires careful policy scoping. Secondary mitigation involves user awareness: since UI:R is required, advising users not to open XML files from untrusted sources provides a behavioral control with no system-level trade-offs.