What is the CVSS score of CVE-2026-11069?

CVE-2026-11069 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11069?

Yes, a patch is available for CVE-2026-11069. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11069

EUVD-2026-34517 MEDIUM

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-cj5q-m4jx-3mh8

Authentication Bypass Google

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

SUSE

MEDIUM

qualitative

Red Hat

9.3 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 18:47 vuln.today

CVSS changed

Jun 05, 2026 - 18:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

DescriptionCVE.org

Insufficient validation of untrusted input in Cast in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Same-origin policy bypass in the Cast component of Google Chrome (prior to 149.0.7827.53) enables a remote unauthenticated attacker to violate cross-origin integrity protections via a crafted HTML page, requiring only that the target user visit the attacker-controlled page. The CVSS vector confirms high integrity impact with no confidentiality or availability consequence, indicating the attack allows unauthorized cross-origin writes or data manipulation rather than information disclosure. No public exploit code has been identified at time of analysis, and the EPSS score of 0.02% (6th percentile) signals low observed exploitation interest despite the medium-severity Chromium classification.

Technical ContextAI

The vulnerability resides in Chrome's Cast subsystem - the component responsible for streaming content to Chromecast and Cast-enabled devices - and stems from CWE-20 (Improper Input Validation) where attacker-controlled input from a crafted HTML page is insufficiently validated before being processed. The Same-Origin Policy (SOP) is a foundational browser security boundary preventing scripts from one origin accessing resources of another; bypassing it enables cross-origin manipulation of content or state. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) indicates this bypass specifically affects data integrity (I:H) without granting read access (C:N), consistent with a scenario where the Cast component permits cross-origin writes or spoofing. Affected product per EUVD: Google Chrome versions in the range below 149.0.7827.53.

RemediationAI

Update Google Chrome to version 149.0.7827.53 or later, which contains the vendor-released patch per the stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism should apply this automatically on restart; users can manually trigger the update via Chrome menu > Help > About Google Chrome. As a compensating control for environments where immediate updates are not feasible, disabling or restricting access to the Cast feature (via enterprise policy CastReceiverEnabled=false or equivalent) removes the vulnerable code path entirely, though this disables casting functionality. Organizations managing Chromium-based browsers (Edge, Brave, etc.) should check their respective vendors for equivalent patch availability, as the upstream fix may not yet be incorporated.