What is the CVSS score of CVE-2026-11135?

CVE-2026-11135 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11135?

Yes, a patch is available for CVE-2026-11135. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11135

EUVD-2026-34596 MEDIUM

Improper Access Control (CWE-284)

2026-06-04 chrome-cve-admin@google.com

GHSA-3vp9-pqvg-4pp2

Authentication Bypass Google Chrome

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Red Hat

5.4 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 05:29 vuln.today

CVSS changed

Jun 06, 2026 - 05:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Insufficient policy enforcement in Google Chrome's Autofill subsystem (versions prior to 149.0.7827.53) enables remote unauthenticated attackers to bypass discretionary access control, resulting in high-integrity impact when a victim visits a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/I:H) confirms the attack is network-delivered, low-complexity, and requires no privileges, though user interaction is a prerequisite. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.02% (4th percentile) reflects low observed exploitation pressure.

Technical ContextAI

The vulnerability resides in Chrome's Autofill feature, which automates form field population and enforces access control policies governing which origins and page contexts can interact with stored autofill data. CWE-284 (Improper Access Control) identifies the root cause as a failure to adequately enforce discretionary access control policies - meaning Chrome does not sufficiently validate whether a given web context is authorized to trigger or manipulate Autofill behavior. A crafted HTML page can exploit this gap to circumvent origin-based or context-based restrictions that Autofill is supposed to uphold. Affected products are confirmed via EUVD as Google Chrome versions in the range 149.0.7827.53 < 149.0.7827.53, meaning all Chrome stable releases prior to 149.0.7827.53 on supported desktop platforms.

RemediationAI

The primary fix is to update Google Chrome to version 149.0.7827.53 or later, which contains the vendor-released patch for this vulnerability. Chrome's auto-update mechanism will apply this for most desktop users automatically; administrators managing enterprise deployments should verify rollout via the Chrome Enterprise release notes and the stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. In environments where immediate patching is not feasible, a compensating control is to disable or restrict Autofill via Chrome's enterprise policy (AutofillAddressEnabled and AutofillCreditCardEnabled group policies set to false) - this eliminates the vulnerable surface but also removes Autofill functionality for end users. Browser-level URL filtering and restricting access to untrusted or external web content via proxy or DNS controls can further reduce exposure, since UI:R means a victim must actively visit a crafted page.