What is the CVSS score of CVE-2026-11133?

CVE-2026-11133 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11133?

Yes, a patch is available for CVE-2026-11133. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11133

EUVD-2026-34594 MEDIUM

Origin Validation Error (CWE-346)

2026-06-04 chrome-cve-admin@google.com

GHSA-5c7c-f2w2-26w7

Authentication Bypass Google

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Red Hat

7.1 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 05:28 vuln.today

CVSS changed

Jun 06, 2026 - 05:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Insufficient same-origin policy enforcement in Google Chrome's Paint rendering component (prior to 149.0.7827.53) allows unauthenticated remote attackers to bypass SOP boundaries via a crafted HTML page, resulting in high integrity impact against the victim's browser context. The attack requires user interaction (visiting a malicious page) but no authentication or elevated privileges. No public exploit code has been identified and no CISA KEV listing exists at time of analysis; EPSS is extremely low at 0.02% (4th percentile), indicating limited observed exploitation activity in the wild.

Technical ContextAI

The vulnerable component is Chrome's Paint subsystem - the portion of the Blink rendering engine responsible for rasterizing and compositing web content onto the screen. The root cause is classified as CWE-346 (Origin Validation Error), meaning the browser fails to correctly verify the origin of content processed through Paint, allowing a crafted HTML page to subvert the same-origin policy (SOP). SOP is the browser's foundational cross-origin isolation boundary: it prevents scripts and resources from one origin from reading or modifying content belonging to a different origin. A bypass here can enable cross-origin content injection or manipulation confined to the browser sandbox (Scope:Unchanged per CVSS). Affected versions are all Chrome stable releases prior to 149.0.7827.53 per the ENISA EUVD entry (EUVD-2026-34594) and Google's June 2026 stable channel advisory. No CPE strings were included in the source data.

RemediationAI

Upgrade Google Chrome to version 149.0.7827.53 or later, as released in the June 2026 stable channel update documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome's built-in auto-update mechanism will apply this patch automatically on most consumer systems; enterprise administrators should verify deployment via endpoint management tools (e.g., Google Admin, Intune, or fleet management dashboards). Prior to patching, organizations may reduce exposure by enforcing enterprise browser policies that restrict navigation to untrusted external URLs, or by deploying web proxy filtering to block access to unknown or unvetted HTML pages - accepting the trade-off of reduced browsing flexibility for end users. No workaround eliminates the root cause in the Paint component; patching to 149.0.7827.53 is the definitive and only confirmed remediation.