What is the CVSS score of CVE-2026-11129?

CVE-2026-11129 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11129?

Yes, a patch is available for CVE-2026-11129. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11129

EUVD-2026-34590 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-04 chrome-cve-admin@google.com

GHSA-m4xv-prr9-c93r

Google CSRF

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Red Hat

7.4 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 05:27 vuln.today

CVSS changed

Jun 06, 2026 - 05:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's Extensions subsystem (versions prior to 149.0.7827.53) enables a remote attacker to exfiltrate sensitive cross-origin data by luring a victim to a crafted HTML page. The flaw is classified under CWE-352 (Cross-Site Request Forgery), indicating the Extensions implementation incorrectly handles cross-origin request validation in a way that bypasses same-origin isolation boundaries. No public exploit has been identified at time of analysis, and an EPSS score of 0.03% (11th percentile) signals low current exploitation probability despite the High confidentiality impact rating.

Technical ContextAI

The vulnerability resides in Google Chrome's Extensions subsystem, where an inappropriate implementation introduces a CSRF-class flaw (CWE-352) that undermines cross-origin data isolation enforced by the browser's same-origin policy. Browser extensions frequently operate with elevated permissions and can interact with page content across multiple origins; when the extension subsystem improperly validates the origin of requests or fails to enforce adequate cross-origin checks, a crafted HTML page can exploit this to leak data from otherwise isolated contexts. The affected product is Google Chrome stable channel prior to version 149.0.7827.53 across all desktop platforms. The CVSS confidentiality impact of High (C:H) combined with zero integrity and availability impact (I:N/A:N) is consistent with a read-only data exfiltration primitive, not arbitrary code execution. The Chromium issue tracker reference (issues.chromium.org/issues/501541962) provides upstream detail, though it may be access-restricted pending broader patch adoption.

RemediationAI

The primary fix is to upgrade Google Chrome to version 149.0.7827.53 or later, which is the vendor-released patch per the stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome auto-updates by default; enterprise administrators should verify fleet-wide deployment and trigger forced updates for managed devices where auto-update is delayed or disabled via policy. As a compensating control where immediate patching is not feasible, restricting third-party Chrome Extension installation using the ExtensionInstallBlocklist or ExtensionInstallAllowlist enterprise policies reduces the extensions attack surface implicated in this flaw, though this does not remediate the underlying vulnerability and may disrupt user workflows dependent on extensions. Additionally, enforcing web filtering to block known malicious or unvetted domains reduces the likelihood of victims reaching attacker-hosted exploit pages that rely on the UI:R prerequisite.