What is the CVSS score of CVE-2026-11062?

CVE-2026-11062 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11062?

Yes, a patch is available for CVE-2026-11062. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11062

EUVD-2026-34510 MEDIUM

Client-Side Enforcement of Server-Side Security (CWE-602)

2026-06-04 chrome-cve-admin@google.com

GHSA-ghwp-rj3v-2jww

Google Code Injection Chrome

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

9.3 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 19:30 vuln.today

CVSS changed

Jun 05, 2026 - 19:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 4.3

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. (Chromium security severity: Medium)

AnalysisAI

Script and HTML injection into privileged Chrome pages is possible in Google Chrome prior to 149.0.7827.53 through insufficient policy enforcement in the Extensions subsystem. An attacker who convinces a user to install a crafted malicious extension can leverage this to inject content into otherwise-restricted privileged pages, compromising page integrity. EPSS is 0.01% (1st percentile), no KEV listing exists, and no public exploit has been identified at time of analysis - indicating low observed exploitation pressure despite the network-accessible attack vector.

Technical ContextAI

CWE-602 (Client-Side Enforcement of Server-Side Security) identifies the root cause: Chrome's extension policy framework, which is meant to enforce boundaries preventing extensions from accessing or modifying privileged browser pages (such as chrome:// URLs or other high-trust contexts), is enforced insufficiently on the client side. The Chrome Extensions subsystem grants extensions a defined set of permissions and content security policy scopes; when these enforcement checks are incomplete, a crafted extension can bypass those boundaries and inject arbitrary scripts or HTML into pages that should be off-limits. The affected product is Google Chrome desktop, versions prior to 149.0.7827.53, as confirmed by EUVD-2026-34510 and the Chromium issue tracker at issues.chromium.org/issues/499033012 (access may be restricted). No CPE string was provided in the input data; affected product scope is inferred from EUVD version data.

RemediationAI

The primary fix is to update Google Chrome to version 149.0.7827.53 or later, which is available via the stable channel update documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome typically auto-updates, but administrators should verify deployment via fleet management tools. As a compensating control prior to patching, enterprise administrators can restrict extension installation using Chrome Enterprise policies - specifically ExtensionInstallBlocklist (set to * to block all) combined with ExtensionInstallAllowlist for approved extensions - to prevent users from installing untrusted or unvetted extensions; this directly eliminates the attack precondition but may disrupt legitimate extension workflows. User awareness about avoiding extension installation from unofficial sources is a secondary, lower-assurance control. No side effects are expected from applying the vendor patch.