What is the CVSS score of CVE-2026-11139?

CVE-2026-11139 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11139?

Yes, a patch is available for CVE-2026-11139. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11139

EUVD-2026-34600 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-04 chrome-cve-admin@google.com

GHSA-qrwr-77q7-5rhh

CSRF Google Chrome

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 05:30 vuln.today

CVSS changed

Jun 06, 2026 - 05:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's Paint component (versions prior to 149.0.7827.53) allows a remote unauthenticated attacker to read sensitive cross-origin data by tricking a user into visiting a crafted HTML page. The flaw stems from an inappropriate implementation in Chrome's rendering Paint subsystem that fails to properly enforce cross-origin isolation boundaries. EPSS is low at 0.03% and no active exploitation is confirmed in CISA KEV, but the high confidentiality impact (C:H) combined with low attack complexity and no required privileges makes this a meaningful data-exfiltration risk for browser users visiting untrusted web content.

Technical ContextAI

The vulnerability resides in the Paint component of the Chromium rendering engine, which is responsible for compositing and rendering visual output to the screen. An inappropriate implementation in this subsystem permits pixel-level or rendered content data to be accessed across origins - breaking the Same-Origin Policy enforced at the rendering layer. The assigned CWE-352 (Cross-Site Request Forgery) appears inconsistent with the described behavior of cross-origin data leakage; the actual root cause is more consistent with CWE-346 (Origin Validation Error) or CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). This discrepancy should be verified against the Chromium issue tracker (https://issues.chromium.org/issues/501650594). Affected product is Google Chrome on desktop platforms prior to version 149.0.7827.53 per EUVD-2026-34600.

RemediationAI

Update Google Chrome to version 149.0.7827.53 or later, which is the vendor-released patch per the Chrome Stable Channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome typically updates automatically, but administrators managing enterprise deployments should verify the rollout via Google Admin Console or push the update through endpoint management tooling. As a compensating control prior to patching, organizations can restrict access to untrusted external web content via web proxy or DNS filtering, though this has significant usability trade-offs. Disabling JavaScript in high-security contexts would limit the attack surface for crafted HTML exploitation but is broadly disruptive. There is no known workaround that fully mitigates the rendering-layer flaw without upgrading the browser.