What is the CVSS score of CVE-2026-11093?

CVE-2026-11093 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11093?

Yes, a patch is available for CVE-2026-11093. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11093

EUVD-2026-34541 MEDIUM

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-r729-m5rf-9jg4

Information Disclosure Google

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

5.9 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 17:31 vuln.today

CVSS changed

Jun 05, 2026 - 17:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

DescriptionCVE.org

Inappropriate implementation in Printing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's Printing subsystem (all versions prior to 149.0.7827.53) enables a remote attacker who has already compromised the renderer process to exfiltrate sensitive cross-origin data by serving a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects high confidentiality impact with no integrity or availability loss, though the real-world attack requires a pre-compromised renderer - making this a second-stage chaining vulnerability rather than a standalone initial-access vector. No public exploit code or CISA KEV listing has been identified, and EPSS at 0.05% (15th percentile) confirms low current exploitation probability.

Technical ContextAI

The vulnerability is rooted in CWE-20 (Improper Input Validation) within Chrome's Printing subsystem, specifically an 'inappropriate implementation' that fails to enforce same-origin policy boundaries during print layout rendering. When a crafted HTML page is processed through the printing pipeline, the subsystem improperly allows access to cross-origin data that should be isolated by Chrome's renderer sandbox. This class of bug is significant in Chromium's multi-process architecture because the renderer sandbox is a key defense layer; bypassing its data isolation via a trusted subsystem like Printing allows an already-compromised renderer to escalate its information access beyond what the sandbox should permit. Affected product scope per EUVD is Google Chrome versions below 149.0.7827.53; no explicit CPE string was provided in the source data.

RemediationAI

The primary remediation is to update Google Chrome to version 149.0.7827.53 or later, which contains the vendor-released patch for this vulnerability. The official release advisory is available at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Enterprise administrators using Chrome management policies should force an update via fleet management tooling (e.g., Google Admin console, Intune, or endpoint management platforms). As a compensating control prior to patching, organizations can restrict access to sensitive cross-origin resources by enforcing network-level segmentation that prevents Chrome instances from reaching high-value internal origins, though this trades usability for reduced exposure. Disabling printing via Chrome enterprise policy (PrintingEnabled=false) would eliminate the attack surface entirely but prevents all legitimate print functionality - a significant trade-off appropriate only for high-security kiosk or locked-down deployments.