What is the CVSS score of CVE-2026-11097?

CVE-2026-11097 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11097?

Yes, a patch is available for CVE-2026-11097. Update the affected software to the latest version immediately.

Google Chrome Android CVE-2026-11097

EUVD-2026-34559 MEDIUM

Use of Function with Inconsistent Implementations (CWE-474)

2026-06-04 chrome-cve-admin@google.com

GHSA-xhhm-m8m8-j8q5

Information Disclosure Google

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Red Hat

7.4 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 04:23 vuln.today

CVSS changed

Jun 06, 2026 - 04:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's WebView component on Android (versions prior to 149.0.7827.53) enables remote attackers to exfiltrate sensitive cross-origin data by directing victims to a specially crafted HTML page. The flaw resides in an inappropriate implementation within WebView (CWE-474), effectively undermining same-origin policy protections that normally isolate web content across origins - an attacker can read data they should not have access to. No public exploit has been identified at time of analysis, and an EPSS score of 0.03% (10th percentile) signals very low current exploitation probability; the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

WebView is Android's embedded browser rendering engine, used by Chrome and third-party apps to display web content within the application context. CWE-474 (Use of Function with Inconsistent Implementations) describes a root cause where a function behaves differently across platforms or contexts than its specification requires - in this case, Chrome's WebView on Android implements cross-origin data handling in a way that diverges from the expected same-origin policy enforcement present in the desktop browser. This inconsistency creates a path for an attacker-controlled page to read responses or data from a different origin, potentially including authenticated API responses, cookies, or private resources loaded in the same WebView context. The vulnerability is platform-specific to Android and does not affect Chrome on Windows, macOS, Linux, or iOS based on available data.

RemediationAI

The primary fix is to update Google Chrome on Android to version 149.0.7827.53 or later, which contains the vendor-released patch per the Google Chrome stable channel advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Android users can apply the update via the Google Play Store or through Chrome's built-in update mechanism (Settings → About Chrome → Update). For organizations managing Android fleets via MDM (Mobile Device Management), enforce the minimum Chrome version policy to 149.0.7827.53. If immediate patching is not feasible, the most actionable compensating control is to restrict users from visiting untrusted web content through Chrome for Android - note this trades usability for risk reduction and does not eliminate the underlying flaw. Disabling WebView-based features in enterprise-managed apps that embed Chrome WebView could further reduce the attack surface, though this may break app functionality. No workaround eliminates the vulnerability without the patch.