What is the CVSS score of CVE-2026-11134?

CVE-2026-11134 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11134?

Yes, a patch is available for CVE-2026-11134. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11134

EUVD-2026-34595 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-04 chrome-cve-admin@google.com

GHSA-2q8q-vfwp-hvch

CSRF Google Chrome

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 05:29 vuln.today

CVSS changed

Jun 06, 2026 - 05:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's Media component (versions prior to 149.0.7827.53) enables remote attackers to exfiltrate sensitive data from cross-origin resources by luring victims to a crafted HTML page. The flaw is rooted in an inappropriate implementation in Chrome's Media subsystem, tagged with CSRF characteristics, allowing an attacker-controlled page to read content from origins the victim is authenticated to. EPSS is low at 0.03% and no public exploit or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

The vulnerability resides in Google Chrome's Media component - the browser subsystem responsible for handling audio, video, and related media resource requests. The root cause is classified as CWE-352 (Cross-Site Request Forgery), suggesting the Media implementation fails to correctly enforce same-origin policy or CSRF protections when making or processing cross-origin media resource requests. When a browser fetches media via elements such as audio or video with cross-origin src attributes, improper handling of the cross-origin response could expose response data - such as headers, partial content, or timing side-channels - back to the requesting origin. No CPE strings were provided in source data; affected scope is derived from EUVD-2026-34595 version data covering all Chrome desktop releases prior to 149.0.7827.53.

RemediationAI

The primary fix is upgrading Google Chrome to version 149.0.7827.53 or later, distributed via the stable channel update documented at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome typically auto-updates on consumer installations, but enterprise administrators should verify deployment through policies such as Google Admin Console or equivalent endpoint management tooling and confirm the installed version meets or exceeds 149.0.7827.53. No official workarounds are confirmed from available source data. As a compensating control pending upgrade, organizations hosting sensitive media or authenticated content can enforce restrictive Content Security Policy headers with narrow media-src directives, which may reduce the attack surface for cross-origin media fetches - though this mitigates exposure on the server side, not the client flaw itself. Browser-level Site Isolation, enabled by default in modern Chrome, may reduce cross-origin data bleed in some scenarios but does not fully remediate this implementation flaw.