What is the CVSS score of CVE-2026-11034?

CVE-2026-11034 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-11034?

Yes, a patch is available for CVE-2026-11034. Update the affected software to the latest version immediately.

Google Chrome Android CVE-2026-11034

EUVD-2026-34483 MEDIUM

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-xjqx-frcx-9w6g

Google Code Injection

6.1

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

8.1 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 20:44 vuln.today

CVSS changed

Jun 05, 2026 - 20:22 NVD

6.1 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.1

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in Tab Group Sync in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via malicious network traffic. (Chromium security severity: Medium)

AnalysisAI

Universal Cross-Site Scripting (UXSS) in Google Chrome for Android's Tab Group Sync feature allows remote unauthenticated attackers to inject arbitrary scripts or HTML via malicious network traffic against Chrome versions prior to 149.0.7827.53. The CVSS Changed Scope (S:C) confirms that injected content escapes the vulnerable component's origin boundary, affecting other origins - the defining characteristic of UXSS, which is more severe than conventional XSS because it bypasses the browser-level same-origin policy rather than just application-level controls. No public exploit has been identified at time of analysis, and EPSS at 0.07% (22nd percentile) reflects low current exploitation probability; the vulnerability is not listed in CISA KEV.

Technical ContextAI

The vulnerable component is Tab Group Sync, a Google Chrome feature on Android that synchronizes tab group state across devices over network channels. CWE-20 (Improper Input Validation) identifies the root cause: the sync mechanism fails to adequately sanitize or validate attacker-influenced data received from the network before processing or rendering it, allowing that data to be interpreted as HTML or JavaScript. This is a browser-engine-level UXSS, distinct from web-application XSS - because the Changed Scope (S:C) in the CVSS:3.1 vector indicates the injected script operates beyond the security boundary of the originating component, crossing into other origins and effectively neutralizing the same-origin policy for the duration of the session. No CPE string was included in the source data; affected product is identified through the ENISA EUVD entry (EUVD-2026-34483) and the Google Chrome Releases advisory as Chrome for Android below version 149.0.7827.53.

RemediationAI

The primary remediation is updating Google Chrome on Android to version 149.0.7827.53 or later, which contains the vendor-released patch as confirmed by the Google Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and the ENISA EUVD entry. Users should update through the Google Play Store immediately. In environments where immediate updates cannot be deployed, a targeted compensating control is disabling the Tab Group Sync feature in Chrome settings (Settings > Google > Sync), which eliminates the vulnerable attack surface - the trade-off is loss of cross-device tab group synchronization functionality. Network-level filtering is not a reliable compensating control because the injection occurs through Chrome's own sync channel, not through browser-rendered web content. Enterprise administrators managing Android fleets via MDM or Android Enterprise policies should push the update through managed app update channels and can enforce Tab Group Sync restrictions via Chrome policy until patching is confirmed.