What is the CVSS score of CVE-2026-11106?

CVE-2026-11106 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11106?

Yes, a patch is available for CVE-2026-11106. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11106

EUVD-2026-34567 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-04 chrome-cve-admin@google.com

GHSA-qj96-2mg8-p4q2

Google CSRF

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 04:28 vuln.today

CVSS changed

Jun 06, 2026 - 04:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's Media component (versions prior to 149.0.7827.53) enables remote attackers to exfiltrate sensitive information from cross-origin pages by luring a victim to a crafted HTML page. The CVSS vector confirms unauthenticated network access with high confidentiality impact (C:H), though user interaction is required (UI:R). No public exploit identified at time of analysis, and EPSS at 0.03% (11th percentile) indicates low near-term mass exploitation probability, aligning with the Chromium team's 'Medium' severity rating.

Technical ContextAI

The vulnerability resides in Chrome's Media component - the browser subsystem responsible for loading, processing, and rendering media resources via HTML elements and related APIs. The CWE-352 (Cross-Site Request Forgery) classification, combined with the 'inappropriate implementation' descriptor and the 'CSRF' tag, suggests the Media component fails to properly enforce cross-origin boundaries when handling media resource requests or responses, potentially allowing a malicious origin to induce media-related requests that expose data belonging to a victim origin. This is an information-disclosure variant of CSRF rather than a state-changing attack, consistent with the CVSS profile of C:H/I:N/A:N. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U) confirms low attack complexity and unchanged scope - exploitation remains within the browser context and does not escape to the underlying OS. The Chromium issue tracker entry (https://issues.chromium.org/issues/500508725) is the authoritative technical source but may be access-restricted pending broader patch adoption.

RemediationAI

The primary fix is to upgrade Google Chrome to version 149.0.7827.53 or later, which contains the vendor-released patch per the stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome's built-in auto-update mechanism should handle this transparently for most end users; enterprise administrators should verify deployment via Chrome Browser Cloud Management or Group Policy and confirm the installed version reaches 149.0.7827.53. No specific workarounds are documented in available sources. As an interim compensating control for unpatched deployments, enabling Chrome's Strict Site Isolation (--site-per-process, which is default in modern Chrome) may reduce cross-origin data leakage risk, though this is not confirmed as sufficient to block this specific vector. Restricting users from browsing untrusted external pages via proxy filtering reduces exposure but carries significant usability trade-offs. Note that Chromium-based browser vendors (Edge, Brave, etc.) should be monitored for their own patch releases addressing the same upstream issue.