What is the CVSS score of CVE-2026-11127?

CVE-2026-11127 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11127?

Yes, a patch is available for CVE-2026-11127. Update the affected software to the latest version immediately.

Google Chrome Android CVE-2026-11127

EUVD-2026-34588 MEDIUM

Improperly Implemented Security Check for Standard (CWE-358)

2026-06-04 chrome-cve-admin@google.com

GHSA-gfg7-62rv-w9mq

Information Disclosure Google

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Red Hat

4.3 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 17:32 vuln.today

CVSS changed

Jun 08, 2026 - 17:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in WebAPKs in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofing via a crafted WebAPK. (Chromium security severity: Medium)

AnalysisAI

Domain spoofing via crafted WebAPK in Google Chrome on Android prior to 149.0.7827.53 enables remote unauthenticated attackers to deceive users about the web origin of installed Progressive Web Apps, with high integrity impact as confirmed by the CVSS I:H rating. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-accessible and requires no privileges, though user interaction is a necessary precondition. No public exploits have been identified and EPSS sits at 0.03% (10th percentile), indicating minimal observed exploitation pressure; however, the trust-abuse potential for phishing campaigns makes timely patching advisable.

Technical ContextAI

WebAPKs are Android Package (APK) files generated by Chrome when a user installs a Progressive Web App (PWA) on Android. This mechanism binds the installed application to a specific web origin, allowing Chrome to grant it elevated trust and display its domain in the browser UI as authoritative. CWE-358 (Improperly Implemented Security Check for Standard) identifies the root cause: the security check responsible for enforcing domain binding within the generated WebAPK is incorrectly implemented, allowing a specially crafted WebAPK to misrepresent its associated origin to the browser. This flaw is exclusive to the Android platform because the WebAPK generation and trust model does not exist in desktop Chrome. No explicit CPE strings were provided in the source data; the affected scope is inferred from the description and EUVD-2026-34588 as all Google Chrome for Android versions prior to 149.0.7827.53.

RemediationAI

Update Google Chrome on Android to version 149.0.7827.53 or later - this is the vendor-released patch confirmed by the Chrome Stable Channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and corroborated by EUVD-2026-34588. Updates are applied via the Google Play Store or Chrome's in-app update prompt. If immediate patching is not feasible, a practical compensating control is to instruct users to avoid installing WebAPKs (PWAs) from untrusted or unfamiliar sources, since exploitation requires user interaction with a crafted WebAPK; note that this does not eliminate risk for already-installed malicious PWAs and does not substitute for patching. Enterprise administrators managing Android Chrome fleets via Google Admin console or MDM should prioritize deploying this update in the next available deployment window.