What is the CVSS score of CVE-2026-11132?

CVE-2026-11132 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11132?

Yes, a patch is available for CVE-2026-11132. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11132

EUVD-2026-34593 MEDIUM

Origin Validation Error (CWE-346)

2026-06-04 chrome-cve-admin@google.com

GHSA-989f-9m7c-hf34

Authentication Bypass Google Chrome

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Red Hat

9.3 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 05:27 vuln.today

CVSS changed

Jun 06, 2026 - 05:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Same-origin policy bypass in Google Chrome's Paint component (all versions prior to 149.0.7827.53) enables a remote unauthenticated attacker to violate cross-origin integrity protections by delivering a crafted HTML page to a victim. The CVSS vector (AV:N/AC:L/PR:N/UI:R/I:H) confirms network-based, low-complexity exploitation with no privilege requirement, though victim interaction - visiting the attacker's page - is mandatory. No public exploit has been identified at time of analysis, and an EPSS score of 0.02% (4th percentile) indicates minimal observed exploitation activity; this is not listed in CISA KEV.

Technical ContextAI

The vulnerability is rooted in CWE-346 (Origin Validation Error), meaning Chrome's Paint rendering subsystem fails to correctly validate or enforce same-origin policy (SOP) boundaries when processing certain HTML content. SOP is a foundational browser security primitive that prevents scripts originating from one site from interacting with resources or content from another. A policy enforcement gap in the Paint layer - which handles compositing and pixel-level rendering - can create a pathway where cross-origin content is rendered or manipulated outside its permitted boundary. The affected product is confirmed as Google Chrome prior to version 149.0.7827.53 (ENISA EUVD-2026-34593). No CPE strings were provided in the input, so exact platform scope (Windows, macOS, Linux, ChromeOS) is not independently confirmed from this dataset alone.

RemediationAI

The primary fix is to update Google Chrome to version 149.0.7827.53 or later, as confirmed by Google's stable channel release advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome typically applies updates automatically; users and administrators should verify the installed version via chrome://settings/help and force-apply pending updates. For enterprise environments, use Chrome's managed update policies (Google Admin Console or GPO) to push 149.0.7827.53 fleet-wide. As a compensating control where immediate patching is not feasible, restricting user browsing to allowlisted trusted domains via browser policy reduces exposure to attacker-controlled pages; however, this is operationally disruptive and does not eliminate the vulnerability. Browser isolation solutions (remote browser isolation or sandboxed profiles) can further reduce the attack surface. No specific workarounds for the Paint component flaw itself have been identified from the available references.