What is the CVSS score of CVE-2026-11090?

CVE-2026-11090 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11090?

Yes, a patch is available for CVE-2026-11090. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11090

EUVD-2026-34538 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-06-04 chrome-cve-admin@google.com

GHSA-jc9w-q838-488c

Information Disclosure Google Chrome

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

7.4 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 17:30 vuln.today

CVSS changed

Jun 05, 2026 - 17:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

DescriptionCVE.org

Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's ANGLE graphics library (versions prior to 149.0.7827.53) allows a remote unauthenticated attacker to read memory across origin boundaries by luring a victim to a crafted HTML page. The root cause is an uninitialized variable (CWE-457) within ANGLE - Chromium's graphics translation layer - which may retain residual data from prior allocations, exposing sensitive cross-origin content. No public exploit code exists and no active exploitation is confirmed (CISA KEV absent); EPSS is 0.03% (11th percentile), indicating low current real-world exploitation pressure.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is the OpenGL ES to native API (Direct3D, Vulkan, Metal) translation layer embedded in all Chromium-based browsers. CWE-457 (Use of Uninitialized Variable) occurs when a memory region is allocated but not zero-initialized before use - its contents reflect whatever data previously occupied that address, potentially including pixels, text, or other rendered content from a different origin. Because ANGLE handles cross-process GPU rendering, uninitialized reads in this subsystem are particularly sensitive: the same physical memory regions may be reused across rendering contexts for different origins, making this a class of speculative/residual data exposure rather than a classic buffer overflow. Affected CPE is implicitly all Google Chrome desktop releases prior to 149.0.7827.53 (Windows, macOS, Linux) as identified by the EUVD affected version range.

RemediationAI

The vendor-released patch is Google Chrome version 149.0.7827.53, available via Chrome's built-in auto-update mechanism or manual download from the official Chrome releases page (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html). Enterprises managing Chrome via policy should deploy this version through their endpoint management tooling immediately. As a compensating control prior to patching, restricting users from browsing untrusted external sites via network-layer URL filtering reduces exposure, though this is operationally disruptive. Disabling JavaScript on unknown origins using Chrome's site settings provides partial mitigation since the exploit is delivered via a crafted HTML page, but will break significant legitimate web functionality. No workaround fully substitutes for upgrading to 149.0.7827.53.