What is the CVSS score of CVE-2026-11025?

CVE-2026-11025 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11025?

Yes, a patch is available for CVE-2026-11025. Update the affected software to the latest version immediately.

Chrome for Android CVE-2026-11025

EUVD-2026-34474 MEDIUM

Client-Side Enforcement of Server-Side Security (CWE-602)

2026-06-04 chrome-cve-admin@google.com

GHSA-j952-52f5-2xr6

Authentication Bypass Google Chrome Red Hat Suse

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Red Hat

8.1 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 15:41 vuln.today

CVSS changed

Jun 08, 2026 - 15:37 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in Navigation in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Content Security Policy bypass in Google Chrome for Android prior to 149.0.7827.53 allows a remote attacker to circumvent CSP restrictions by delivering a crafted HTML page to a victim user. The flaw resides in Chrome's Navigation subsystem, where policy enforcement is insufficient, enabling injection or execution of content that CSP headers would otherwise block. No public exploit has been identified at time of analysis, and EPSS sits at the 4th percentile, but the zero-privilege-required, network-accessible attack surface warrants prompt patching on Android deployments.

Technical ContextAI

CWE-602 (Client-Side Enforcement of Server-Side Security) identifies the root cause: security logic that should be enforced server-side - or uniformly across the browser stack - is instead delegated to the client-side Navigation component, where it can be bypassed. Content Security Policy is a browser-enforced mechanism that restricts which scripts, styles, and resources a page may load or execute. In Chrome's Android Navigation layer, the handling of navigations through crafted HTML can circumvent these restrictions. The affected CPE scope is Google Chrome versions below 149.0.7827.53 running on Android. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms network delivery, no authentication requirement, but mandatory user interaction, with the sole impact being high integrity violation - consistent with unauthorized content injection or script execution bypassing CSP.

RemediationAI

Vendor-released patch: Chrome 149.0.7827.53 for Android. Users and administrators should update Chrome on all managed Android devices to version 149.0.7827.53 or later via the Google Play Store or enterprise mobile device management tooling. The official release advisory is available at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Where immediate update is not feasible, a compensating control is to enforce browser update policies via MDM or restrict access to untrusted external web content using network-layer filtering (e.g., DNS or proxy-based URL categorization), noting this does not eliminate the vulnerability and introduces usability trade-offs. There are no documented workarounds that fully neutralize the CSP bypass without applying the patch.