What is the CVSS score of CVE-2026-11121?

CVE-2026-11121 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11121?

Yes, a patch is available for CVE-2026-11121. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11121

EUVD-2026-34582 MEDIUM

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-74fx-7f23-gg6j

Information Disclosure Google

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Red Hat

6.8 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 16:25 vuln.today

CVSS changed

Jun 08, 2026 - 16:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's Skia graphics library affects all versions prior to 149.0.7827.53, exploitable by a remote attacker who has already compromised the renderer process. Via a crafted HTML page, the attacker can abuse insufficient input validation in Skia to extract sensitive cross-origin data, bypassing browser isolation boundaries. No public exploit code has been identified at time of analysis, and the EPSS score of 0.05% (15th percentile) reflects low observed exploitation activity.

Technical ContextAI

Skia is Google's open-source 2D graphics engine, embedded in Chrome as the primary rendering backend for canvas, compositing, and image operations. The vulnerability is rooted in CWE-20 (Improper Input Validation): Skia fails to adequately validate untrusted input, enabling data to escape its intended rendering scope and be read cross-origin. The affected component resides within Chrome's renderer process sandbox. The attack surface is limited to already-sandboxed renderer context, meaning this flaw is most relevant as a second-stage component in a multi-step exploit chain - a renderer compromise must precede exploitation. Affected CPE is consistent with all Chrome desktop versions below 149.0.7827.53 across supported platforms (Windows, macOS, Linux).

RemediationAI

Update Google Chrome to version 149.0.7827.53 or later - this is the vendor-released patch confirmed via the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome auto-updates by default; administrators should verify fleet compliance using enterprise management tooling (e.g., Google Admin Console, Intune). For environments where immediate patching is not possible, restricting execution of untrusted or external web content via enterprise policy (e.g., enforcing SafeBrowsing, blocking untrusted extensions, or disabling JavaScript for untrusted origins via policy) reduces the surface area, though none of these fully mitigate the flaw. Note that exploitation requires a prior renderer compromise, so patching any co-present renderer-sandbox escape vulnerabilities is equally critical to breaking the full attack chain.