What is the CVSS score of CVE-2026-11081?

CVE-2026-11081 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11081?

Yes, a patch is available for CVE-2026-11081. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11081

EUVD-2026-34529 MEDIUM

Origin Validation Error (CWE-346)

2026-06-04 chrome-cve-admin@google.com

GHSA-fw2c-hw9c-74wv

Authentication Bypass Google

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

SUSE

MEDIUM

qualitative

Red Hat

9.3 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 18:48 vuln.today

CVSS changed

Jun 05, 2026 - 18:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

DescriptionCVE.org

Inappropriate implementation in Canvas in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Same-Origin Policy bypass in Google Chrome's Canvas implementation affects all versions prior to 149.0.7827.53, allowing a remote unauthenticated attacker to violate cross-origin integrity guarantees through a crafted HTML page. The vulnerability carries a High integrity impact (I:H) with no confidentiality or availability consequence, meaning an attacker can write or manipulate cross-origin data rather than read it. No public exploit code has been identified at time of analysis, and EPSS at 0.02% (4th percentile) suggests minimal observed exploitation pressure currently.

Technical ContextAI

The vulnerability resides in Chrome's HTML Canvas API implementation, which exposes a 2D and WebGL drawing surface to JavaScript. CWE-346 (Origin Validation Error) identifies the root cause: the browser's Canvas subsystem fails to correctly enforce origin boundaries, allowing a document from one origin to interact with or influence canvas state that should be isolated to another origin. The Same-Origin Policy (SOP) is a foundational browser security primitive; a flaw in its Canvas enforcement can allow cross-origin writes or tainting bypasses. The affected product per ENISA EUVD and NVD CPE data is Google Chrome versions below 149.0.7827.53 on the desktop stable channel. Chromium has internally classified this as Medium severity (consistent with CVSS 6.5).

RemediationAI

The primary remediation is to update Google Chrome to version 149.0.7827.53 or later, which contains the vendor-released patch for this issue. Enterprise administrators should verify Chrome is on the current stable channel via chrome://settings/help or fleet management tooling and push the update immediately. The release announcement is documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. For environments where immediate upgrade is not feasible, compensating controls include enforcing Content Security Policy (CSP) headers with strict same-origin directives on internal web applications to reduce the attack surface, and restricting navigation to untrusted external URLs via browser enterprise policy (URLBlocklist). Note that CSP controls are server-side mitigations for sites you control and do not prevent a user from navigating to an attacker-controlled page independently. No workaround fully substitutes for the upstream patch.