What is the CVSS score of CVE-2026-11107?

CVE-2026-11107 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11107?

Yes, a patch is available for CVE-2026-11107. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11107

EUVD-2026-34568 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-04 chrome-cve-admin@google.com

GHSA-fxq7-qx43-88x5

Information Disclosure Google

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Red Hat

0.0 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 04:28 vuln.today

CVSS changed

Jun 06, 2026 - 04:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 4.3

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Downloads in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing in Google Chrome's Downloads component prior to version 149.0.7827.53 enables remote attackers to misrepresent download-related interface elements by serving a crafted HTML page. The flaw stems from an inappropriate implementation (CWE-451) in the Downloads subsystem, allowing an attacker to manipulate what the user sees during a download interaction - potentially masking file names, types, or origin - without any authentication. No public exploit code exists and EPSS sits at 0.03% (11th percentile), indicating no public exploit identified at time of analysis; however, the no-authentication, low-complexity delivery path warrants prompt patching.

Technical ContextAI

CWE-451 (User Interface Misrepresentation of Critical Information) describes a class of flaws where the application fails to accurately or consistently present security-relevant information to the user, allowing an attacker to substitute or obscure it. In Google Chrome, the Downloads component is responsible for rendering download prompts, file names, MIME types, and source origins. An inappropriate implementation in this subsystem means a crafted HTML page can inject or alter UI elements that the browser surfaces during a download event - for example, spoofing the displayed filename or download origin to deceive the user. The affected codebase is tracked upstream at Chromium issue 500510384. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N confirms the flaw is reachable over the network with low complexity, requires no privileges, needs only a single user interaction (visiting the page), and produces a limited integrity impact with no confidentiality or availability consequence.

RemediationAI

Update Google Chrome to version 149.0.7827.53 or later, which contains the vendor-released patch for this issue. The stable channel update is documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism will deliver the fix automatically for most desktop users; administrators managing enterprise deployments should push the update via policy (Google Admin Console or third-party MDM) without delay. As a compensating control where immediate patching is not feasible, organizations can restrict access to untrusted external URLs through web proxies or DNS filtering to reduce the likelihood of users reaching a crafted page. However, this is a partial mitigation only - it does not remediate the underlying flaw and will not protect against internally hosted or already-cached malicious pages. No functional workaround within Chrome itself is documented at this time.