What is the CVSS score of CVE-2026-11023?

CVE-2026-11023 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11023?

Yes, a patch is available for CVE-2026-11023. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11023

EUVD-2026-34472 MEDIUM

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-49rg-f6g3-crgf

Authentication Bypass Google Chrome Red Hat Suse

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Red Hat

7.9 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 15:40 vuln.today

CVSS changed

Jun 08, 2026 - 15:37 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in WebAppInstalls in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Same-origin policy bypass in Google Chrome's WebAppInstalls component allows a remote attacker who has already compromised the renderer process to circumvent cross-origin protections via a crafted HTML page, yielding high integrity impact with no confidentiality or availability loss. All Chrome versions prior to 149.0.7827.53 are affected. No public exploit code has been identified and EPSS places this at the 6th percentile (0.02%), indicating very low observed exploitation probability; this is not listed in CISA KEV.

Technical ContextAI

The vulnerable component is WebAppInstalls, Chrome's subsystem responsible for handling Progressive Web App (PWA) installation flows. CWE-20 (Improper Input Validation) indicates the root cause is insufficient validation of inputs or state within this component, allowing an already-compromised renderer to pass maliciously crafted data that the browser process incorrectly trusts. The same-origin policy (SOP) is a foundational browser security boundary that prevents content from one origin from reading or manipulating resources of another; bypassing it can allow unauthorized writes or modifications across origins. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N reflects a network-delivered attack requiring user interaction (e.g., visiting a crafted page), with high integrity impact but no scope change, meaning the damage is contained to the compromised context rather than propagating to other security domains.

RemediationAI

Update Google Chrome to version 149.0.7827.53 or later, which contains the vendor-released patch for this vulnerability per the stable channel advisory at chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome auto-update should handle this for most end users; enterprise administrators should verify managed deployments are on 149.0.7827.53+ via policy. As a compensating control where immediate patching is not possible, disabling or restricting PWA installation features via enterprise policy (Chrome's 'WebAppInstallForceList' and related policies) may reduce the attack surface of the WebAppInstalls component, though this would prevent legitimate PWA functionality. Additionally, since exploitation requires a prior renderer compromise, ensuring Chrome's site isolation (--site-per-process) is enforced and keeping the browser sandbox intact are meaningful layered defenses. No workaround fully substitutes for the patch.