What is the CVSS score of CVE-2026-11039?

CVE-2026-11039 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11039?

Yes, a patch is available for CVE-2026-11039. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11039

EUVD-2026-34488 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-06-04 chrome-cve-admin@google.com

GHSA-gm9m-59jm-wj99

Information Disclosure Google Chrome

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 20:44 vuln.today

CVSS changed

Jun 05, 2026 - 20:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's Skia graphics library (prior to 149.0.7827.53) enables a remote attacker to read sensitive data from other origins by enticing a user to visit a crafted HTML page. The flaw stems from uninitialized memory use (CWE-457) in Skia, Chrome's 2D rendering engine, where residual memory contents can be exposed across security boundaries. No active exploitation has been confirmed (not in CISA KEV) and EPSS sits at 0.03% (11th percentile), indicating low real-world exploitation probability at time of analysis, though the confidentiality impact is rated High by CVSS.

Technical ContextAI

Skia is Google's open-source 2D graphics library embedded in Chrome for rendering web content, including canvas, CSS effects, and SVG. CWE-457 (Use of Uninitialized Variable) describes a class of bug where memory is allocated but not properly zeroed or set before use, leaving it populated with residual data from prior allocations or adjacent memory regions. In a browser context, this residual data can originate from other origins' rendering operations, making the flaw a cross-origin information disclosure vector. The affected versions are all Chrome releases prior to 149.0.7827.53 on desktop platforms, as confirmed by EUVD entry EUVD-2026-34488 and the ENISA affected-versions data. CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N confirms the attack is purely a confidentiality breach with no integrity or availability component, which is consistent with an uninitialized-read scenario rather than memory corruption for code execution.

RemediationAI

Upgrade Google Chrome to version 149.0.7827.53 or later, which contains the vendor-released patch for this issue. The stable channel update is documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism will deliver this patch automatically on most desktop platforms; administrators managing enterprise deployments should verify update policy compliance via Google Admin Console or equivalent MDM tooling. If immediate patching is not feasible, a compensating control is to restrict users from browsing untrusted or external HTML content through network-level web filtering or browser isolation solutions - note this does not eliminate the vulnerability but reduces exposure. Disabling JavaScript or canvas rendering via enterprise policy would degrade browser functionality significantly and is not recommended as a practical workaround. For environments with strict cross-origin data sensitivity, treat unpatched Chrome instances as untrusted until upgraded.