What is the CVSS score of CVE-2026-11145?

CVE-2026-11145 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11145?

Yes, a patch is available for CVE-2026-11145. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11145

EUVD-2026-34606 MEDIUM

Race Condition (CWE-362)

2026-06-04 chrome-cve-admin@google.com

GHSA-57pw-4xmg-7294

Information Disclosure Google Race Condition Chrome

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Red Hat

6.1 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Jun 08, 2026 - 19:22 NVD

6.5 (MEDIUM) 5.3 (MEDIUM)

Analysis Generated

Jun 06, 2026 - 05:33 vuln.today

CVSS changed

Jun 06, 2026 - 05:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Race in Geolocation in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome for Android (versions prior to 149.0.7827.53) is enabled by a race condition in the Geolocation subsystem, exploitable by a remote unauthenticated attacker who tricks a victim into visiting a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network reachability with no required privileges, though user interaction is mandatory. No active exploitation has been confirmed (not in CISA KEV), and EPSS sits at 0.03% (10th percentile), indicating very low real-world exploitation probability despite the High confidentiality impact rating.

Technical ContextAI

The root cause is CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization), a classic race condition in Chrome's Geolocation API implementation specific to the Android platform. Race conditions in browser geolocation handling typically arise when asynchronous geolocation callbacks or multiple threads access shared state without adequate locking, creating timing windows that an attacker-controlled page can exploit to read data that the same-origin policy should isolate. The Android-specific nature of the bug likely relates to platform-specific Geolocation provider implementations (e.g., Android's FusedLocationProvider integration) that differ from desktop codepaths. No explicit CPE string was provided in the source data, but the ENISA EUVD entry EUVD-2026-34606 identifies the affected range as Chrome for Android versions below 149.0.7827.53. The scope is unchanged (S:U), meaning the vulnerability does not enable sandbox escape - impact is confined to cross-origin information disclosure.

RemediationAI

Update Google Chrome on Android to version 149.0.7827.53 or later, available through the Google Play Store or Chrome's built-in update mechanism (Menu → Help → About Google Chrome). The vendor-released patch is confirmed available per the stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Enterprise administrators should enforce the update via mobile device management (MDM) policies targeting the Android Chrome package. As a compensating control for devices where immediate update is not possible, revoking Chrome's location permission in Android system settings (Settings → Apps → Chrome → Permissions → Location → Deny) eliminates the Geolocation attack surface, though this will break legitimate geolocation-dependent web functionality for the user. No other workarounds are identified from the available data.