What is the CVSS score of CVE-2026-11128?

CVE-2026-11128 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11128?

Yes, a patch is available for CVE-2026-11128. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11128

EUVD-2026-34589 MEDIUM

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-xg59-63m4-q3xm

Information Disclosure Google Chrome Red Hat Suse

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 17:32 vuln.today

CVSS changed

Jun 08, 2026 - 17:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Web Share in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's Web Share API prior to version 149.0.7827.53 allows a remote attacker to extract sensitive cross-origin information by convincing a user to perform specific UI gestures on a crafted HTML page, violating browser same-origin policy guarantees. The CVSS vector (AV:N/AC:L/PR:N/UI:R/C:H) reflects high confidentiality impact with no authentication required on the attacker's side, though mandatory user interaction reduces realistic exploitation probability significantly. No public exploit has been identified at time of analysis, and an EPSS score of 0.04% (13th percentile) corroborates low current exploitation activity.

Technical ContextAI

The Web Share API is a modern browser capability that allows web pages to invoke the operating system's native sharing mechanism, passing data such as URLs, text, and files to external apps. The root cause is classified as CWE-20 (Improper Input Validation), meaning Chrome's implementation of this API fails to properly validate or sanitize the data flow in a way that inadvertently exposes cross-origin content to the initiating page. This represents a breakdown of the browser's fundamental cross-origin isolation boundary. Affected versions span all Chrome desktop builds (Windows, macOS, Linux) prior to 149.0.7827.53, as confirmed by EUVD-2026-34589. The Chromium issue tracker reference (issues.chromium.org/issues/501541341) may contain additional technical detail but is likely access-restricted pending broader patch adoption.

RemediationAI

Upgrade Google Chrome to version 149.0.7827.53 or later, which is the vendor-released patch per the official Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Enterprise administrators should push this update via Chrome Browser Cloud Management or GPO-based update policies to ensure fleet-wide coverage. If immediate patching is not feasible, a targeted compensating control is to disable or restrict access to the Web Share API via enterprise policy (ContentSettings or PermissionsPolicy headers with 'web-share' denied), though this will break legitimate share functionality on internal web apps. Browser component-level isolation via Site Isolation should already be enabled by default in Chrome and provides partial mitigation depth, but does not eliminate the vulnerability. No evidence of available workarounds that fully substitute for the patch.