What is the CVSS score of CVE-2026-11084?

CVE-2026-11084 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11084?

Yes, a patch is available for CVE-2026-11084. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11084

EUVD-2026-34532 MEDIUM

Origin Validation Error (CWE-346)

2026-06-04 chrome-cve-admin@google.com

GHSA-49xg-2gwq-cjm3

Information Disclosure Google

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 18:49 vuln.today

CVSS changed

Jun 05, 2026 - 18:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

DescriptionCVE.org

Inappropriate implementation in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's Password Manager component (prior to 149.0.7827.53) exposes sensitive credential or form data to remote attackers through a crafted HTML page. The flaw stems from an inappropriate implementation classified under CWE-346 (Origin Validation Error), meaning the Password Manager fails to properly enforce same-origin boundaries when handling data. No privileges are required and exploitation is conditional only on user interaction with a malicious page; CVSS confidentiality impact is rated High, though no public exploit code exists and EPSS is at 0.03%, indicating low observed exploitation pressure at time of analysis.

Technical ContextAI

The vulnerability resides in the Password Manager subsystem of the Chromium rendering engine. CWE-346 (Origin Validation Error) identifies the root cause as a failure to correctly validate or enforce origin boundaries - the browser's Password Manager does not adequately separate data associated with one origin from requests or pages belonging to another. This is a same-origin policy (SOP) bypass class of bug: the affected component, when processing a specially crafted HTML page, can be manipulated to surface credential or autofill data belonging to a different origin than the requesting context. Affected CPE is Google Chrome versions prior to 149.0.7827.53 on desktop platforms. The Chromium issue tracker entry (https://issues.chromium.org/issues/500124500) contains upstream detail, though it may be access-restricted per standard Chrome security disclosure policy.

RemediationAI

The primary remediation is to update Google Chrome to version 149.0.7827.53 or later, which contains the vendor-released patch for this issue. The stable channel update is documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Organizations managing Chrome deployments via policy should push this update through their endpoint management tooling promptly. As a compensating control pending update deployment, administrators can disable Chrome's built-in Password Manager via enterprise policy (PasswordManagerEnabled=false), which eliminates the vulnerable attack surface at the cost of removing autofill credential functionality - users will need to rely on a third-party password manager or manual entry. Restricting users from browsing to untrusted external sites via web filtering can reduce exposure but is not a substitute for patching. No side effects from applying the update itself have been reported.