What is the CVSS score of CVE-2026-11036?

CVE-2026-11036 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11036?

Yes, a patch is available for CVE-2026-11036. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11036

EUVD-2026-34485 MEDIUM

Origin Validation Error (CWE-346)

2026-06-04 chrome-cve-admin@google.com

GHSA-v4w3-fffw-5h9j

Authentication Bypass Google

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

SUSE

MEDIUM

qualitative

Red Hat

9.3 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 19:30 vuln.today

CVSS changed

Jun 05, 2026 - 19:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in DOM in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Same-origin policy bypass in Google Chrome prior to 149.0.7827.53 enables remote unauthenticated attackers to violate cross-origin isolation boundaries through a crafted HTML page, producing high integrity impact with no confidentiality or availability loss. Rooted in an inappropriate DOM implementation (CWE-346: Origin Validation Error), the flaw allows a malicious page to cross origin boundaries and manipulate content or state belonging to a different origin. No public exploit code and no CISA KEV listing exist at time of analysis; the EPSS score of 0.02% (4th percentile) reinforces limited real-world exploitation pressure despite the medium CVSS 6.5 rating.

Technical ContextAI

The vulnerability resides in Chrome's Document Object Model (DOM) implementation and is classified as CWE-346 (Origin Validation Error). The same-origin policy (SOP) is a foundational browser security primitive restricting cross-origin script interaction with resources such as cookies, DOM state, and network responses. An 'inappropriate implementation' in the DOM layer indicates that Chrome fails to correctly enforce origin checks in a specific execution path, permitting a crafted HTML page to influence or modify content governed by a different origin. The affected product is Google Chrome desktop (Windows, macOS, Linux) for all versions prior to 149.0.7827.53, as confirmed by the Chrome stable channel advisory and ENISA EUVD-2026-34485. The Chromium issue tracker entry (https://issues.chromium.org/issues/497964917) may contain additional technical detail but is likely access-restricted pending broader patch adoption.

RemediationAI

Vendor-released patch: Chrome 149.0.7827.53. Update Google Chrome to version 149.0.7827.53 or later using the stable channel update documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome auto-updates by default on most desktop configurations; enterprise administrators using managed deployments (Google Admin Console, GPO, or Intune) should validate update rollout and confirm the installed version via chrome://settings/help. As a compensating control pending patch deployment, enforcing a Content Security Policy (CSP) on sensitive web applications can partially limit the damage of a SOP bypass by restricting what cross-origin interactions are permitted - though this mitigates impact on defender-controlled sites, not the browser flaw itself. Disabling JavaScript is a theoretical but operationally disruptive workaround not recommended for general use. Given the UI:R requirement, user-awareness guidance against clicking unsolicited links provides marginal but real risk reduction.