What is the CVSS score of CVE-2026-11048?

CVE-2026-11048 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11048?

Yes, a patch is available for CVE-2026-11048. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11048

EUVD-2026-34497 MEDIUM

Origin Validation Error (CWE-346)

2026-06-04 chrome-cve-admin@google.com

GHSA-mx9q-p75x-m88c

Authentication Bypass Google

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.4 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 20:46 vuln.today

CVSS changed

Jun 05, 2026 - 20:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to bypass same origin policy via a crafted Chrome Extension. (Chromium security severity: Medium)

AnalysisAI

Same-origin policy bypass in Google Chrome's Extensions subsystem (versions prior to 149.0.7827.53) allows an attacker who socially engineers a user into installing a crafted malicious extension to violate cross-origin boundaries, enabling unauthorized integrity impact against content from other origins. The CVSS vector (I:H, C:N) confirms the impact is write/modify-only - sensitive data exfiltration is not a direct consequence. No public exploit code or active exploitation has been identified at time of analysis; EPSS is negligible at 0.01% (1st percentile), consistent with the social-engineering prerequisite limiting mass exploitation.

Technical ContextAI

The root cause is classified as CWE-346 (Origin Validation Error), an inappropriate implementation within Chrome's Extensions API that fails to correctly enforce same-origin policy (SOP) restrictions for crafted extensions. SOP is a foundational browser security boundary preventing scripts loaded from one origin from accessing or modifying resources belonging to another. Chrome extensions operate in a privileged context with access to tabs, content scripts, and cross-origin messaging APIs, making defects in how the extension sandbox validates origin boundaries particularly dangerous. The flaw allows a specially crafted extension to exploit this implementation gap and bridge origin isolation that Chrome's security model is designed to enforce. Affected product is Google Chrome for desktop, all builds prior to stable release 149.0.7827.53, as confirmed by ENISA EUVD-2026-34497.

RemediationAI

Upgrade Google Chrome to version 149.0.7827.53 or later, as confirmed by the vendor's stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome auto-updates by default; verify the installed version via chrome://settings/help. As a targeted compensating control prior to or alongside patching, enforce extension installation policies through Chrome Enterprise or Google Admin Console to restrict users to an approved allowlist of extensions - this directly eliminates the attack vector by preventing malicious extension installation. The trade-off is reduced user autonomy around extension choice. Organizations without enterprise management should instruct users to install extensions only from trusted, vetted sources and to reject unsolicited extension installation prompts.