What is the CVSS score of CVE-2026-11035?

CVE-2026-11035 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-11035?

Within 24 hours: Verify Chrome for Android version distribution across managed and BYOD device inventory. Within 7 days: Deploy Chrome 149.0.7827.53 or later to all managed Android devices and distribute patch guidance to end users. Within 30 days: Confirm 95%+ patch deployment across organizational Chrome for Android installations and document completion in vulnerability management system.

Google Chrome CVE-2026-11035

Q: Which versions of Google Chrome are affected by CVE-2026-11035?

Google Chrome for Android versions prior to 149.0.7827.53 contain a privilege escalation vulnerability in the Custom Tabs component that could allow an attacker with device access to elevate their…. A patch is available.

EUVD-2026-34484 HIGH

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-2wp5-pmpm-74rh

Privilege Escalation Google

7.3

CVSS 3.1 · Vendor: google

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Install malicious app on Android device
Delivery

Invoke Chrome Custom Tabs with crafted XML
Exploit

Trick user into interacting with prompt
Execution

Trigger improper input validation in Custom Tabs
Persist

Escalate privileges within Chrome context
Impact

Access Chrome profile data or capabilities

Vulnerability Assessment

Weakness	CWE CWE-20 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V2 - Validation and Business Logic Input validation, allowlisting
Exploitation Conditions	Attacker must already have code execution as a separate local Android app on the same device (AV:L, PR:L) and must induce the victim to interact with a UI element such as a Custom Tabs prompt or dialog (UI:R). The crafted XML file must be delivered through the Custom Tabs API surface on the Android port of Chrome specifically - desktop Chrome is not described as affected. The target device must be running Chrome for Android at a version below 149.0.7827.53, and the user must accept the interaction step, which limits opportunistic mass exploitation.
Impact	Signals are mixed but lean toward limited real-world urgency. The CVSS vector (AV:L/AC:L/PR:L/UI:R) confirms this is a local attack requiring an existing foothold (a malicious or compromised app on the device) plus user interaction, which sharply narrows the threat population versus a remote bug. The EPSS score of 0.02% (4th percentile) and absence of CISA KEV listing align with this - no public exploit identified at time of analysis. Google's own severity rating of 'Medium' is consistent with the CVSS 7.3 high impact triad (C:H/I:H/A:H) being gated by local access. Note one inconsistency worth flagging: the EUVD record lists 'Chrome 149.0.7827.53 <149.0.7827.53' as affected, which is self-contradictory and almost certainly a data-entry artifact - the description clearly states versions prior to 149.0.7827.53 are vulnerable.
Exploit ScenarioDerived	A user installs a seemingly benign Android app from a sideloaded APK or a low-reputation store; that app invokes a Chrome Custom Tabs intent with a crafted XML payload and induces the user to tap a prompt (satisfying UI:R). The crafted input triggers the Custom Tabs handler to perform an action with Chrome's privileges that the calling app could not perform on its own, resulting in elevated access to Chrome's profile data or capabilities. No public exploit identified at time of analysis.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 05, 2026

Local privilege escalation in Google Chrome for Android prior to 149.0.7827.53 stems from an inappropriate implementation in the Custom Tabs component, where a crafted XML file processed by a local attacker can elevate privileges within the browser context. The flaw is rated CVSS 7.3 (Chromium severity Medium) and requires user interaction, with no public exploit identified at time of analysis and a very low EPSS score (0.02%, 4th percentile). A vendor patch is available in the Stable channel update referenced by the Chrome Releases advisory.

RemediationAI

Vendor-released patch: Chrome for Android 149.0.7827.53 - update via Google Play Store or enterprise mobile device management to this version or later, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and Chromium issue tracker entry https://issues.chromium.org/issues/497936421. As compensating controls until the update is rolled out, restrict installation of untrusted third-party apps (since the attack requires a malicious local app to deliver the crafted XML), disable 'Install from Unknown Sources' on managed devices via MDM policy, and consider temporarily disabling Custom Tabs integrations in security-sensitive enterprise apps if feasible - though this will break in-app browsing experiences that rely on the Custom Tabs API.

Affected VersionsENISA

Chrome 149.0.7827.53 <149.0.7827.53

Affected Packages

euvd chrome fix: 149.0.7827.53

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Chrome Custom Tabs is an Android-specific browser surface that lets third-party apps embed a customized Chrome browsing experience while sharing the user's Chrome profile, cookies, and saved state. Per CWE-20 (Improper Input Validation), the underlying defect lies in how the Custom Tabs implementation parses or trusts attacker-controlled XML input - likely an Intent extra or resource file passed from a co-resident Android application - without sufficient validation, enabling the caller to influence behavior that should be restricted to Chrome's own privilege boundary. Because Android isolates apps via UIDs, a successful exploit lets a lower-privileged app cross into actions normally reserved for the Chrome app itself.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (google) PRIMARY 7.3 HIGH

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

SUSE HIGH

Red Hat 7.1 MEDIUM

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Jun 05, 2026 - 20:22 NVD

7.3 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 7.3

DescriptionCVE.org

Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to perform privilege escalation via a crafted XML file. (Chromium security severity: Medium)

Executive ViewAI

Why It Matters

Google Chrome for Android versions prior to 149.0.7827.53 contain a privilege escalation vulnerability in the Custom Tabs component that could allow an attacker with device access to elevate their privileges within the browser context. While the technical severity is rated HIGH (CVSS 7.3), actual organizational threat is minimal given no public exploit identified at time of analysis and extremely low exploitation probability (0% EPSS); however, Chrome's ubiquity on Android devices warrants timely patching to maintain security posture.

Business Impact: Medium

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.0%

Top 96% exploitable

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment MSRC Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Defer

Exploitation

None

System Exposure· derived

Small

Automatable

Human Impact

Medium

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +36

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.