What is the CVSS score of CVE-2026-11022?

CVE-2026-11022 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11022?

Yes, a patch is available for CVE-2026-11022. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11022

EUVD-2026-34471 MEDIUM

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-vjw7-436q-gmrc

Authentication Bypass Google Chrome Red Hat Suse

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Red Hat

8.7 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 16:25 vuln.today

CVSS changed

Jun 08, 2026 - 16:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Same-origin policy bypass in Google Chrome DevTools (versions prior to 149.0.7827.53) enables a remote attacker who has already compromised the renderer process to cross origin boundaries via a crafted HTML page. The flaw stems from insufficient input validation (CWE-20) within the DevTools component, yielding a High integrity impact while leaving confidentiality and availability unaffected. No public exploit code exists at time of analysis, and EPSS sits at 0.02% (6th percentile), indicating low observed exploitation pressure; this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Technical ContextAI

Google Chrome's multi-process architecture isolates web content inside renderer processes, relying on the same-origin policy (SOP) enforced by the browser process to prevent cross-origin data access. DevTools, the built-in developer tooling layer, communicates with renderer processes with elevated trust. CWE-20 (Improper Input Validation) here means that DevTools fails to adequately validate attacker-controlled input originating from a compromised renderer, allowing that renderer to send crafted messages or HTML that DevTools processes without proper origin checks. The affected CPE covers Google Chrome on all desktop platforms prior to version 149.0.7827.53, as confirmed by the ENISA EUVD entry EUVD-2026-34471 and the Chrome stable channel release advisory. The Chromium security severity is rated Medium, consistent with the precondition of an already-compromised renderer.

RemediationAI

Update Google Chrome to version 149.0.7827.53 or later, which addresses this vulnerability per the vendor's stable channel update advisory at chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism will apply the patch automatically on most desktop installations; users should verify their version via chrome://settings/help and restart the browser to complete the update. As a compensating control, organizations that cannot immediately update may consider disabling access to DevTools in managed Chrome deployments via the DeveloperToolsAvailability enterprise policy - note this limits developer and debugging workflows as a trade-off. Additionally, restricting exposure to untrusted HTML content reduces the likelihood of renderer compromise, which is a required prerequisite for this specific bypass.