What is the CVSS score of CVE-2026-11148?

CVE-2026-11148 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11148?

Yes, a patch is available for CVE-2026-11148. Update the affected software to the latest version immediately.

Google Chrome Android CVE-2026-11148

EUVD-2026-34609 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-04 chrome-cve-admin@google.com

GHSA-4fhj-373m-9qjj

Google CSRF

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Red Hat

6.3 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 05:33 vuln.today

CVSS changed

Jun 06, 2026 - 05:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Payments in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage via an inappropriate CSRF-class implementation in Google Chrome's Payments component on Android prior to 149.0.7827.53 allows network-delivered exploitation when a victim visits a crafted HTML page. The confidentiality impact is rated High by CVSS (C:H), as sensitive payment-related data from one origin can be exposed to an attacker-controlled page. No public exploit has been identified at time of analysis and the EPSS score of 0.01% (1st percentile) indicates a low probability of in-the-wild exploitation, making this a medium-priority patch rather than an emergency response item.

Technical ContextAI

The vulnerability resides in Chrome's Payments subsystem on Android, which implements the W3C PaymentRequest API - a browser-native interface for initiating and managing web-based payment flows, including stored payment credentials and merchant interaction state. The CWE-352 classification (Cross-Site Request Forgery) and the 'CSRF' tag both indicate that the root cause is the Payments component's failure to enforce adequate same-origin or CSRF token validation, permitting a malicious page to trigger or interact with payment-related browser state belonging to a different origin. This class of flaw can expose user payment method metadata, merchant-bound session data, or internal payment API responses to the attacker's origin. The flaw is scoped exclusively to the Android build of Chrome; no CPE string for desktop platforms is listed in the affected version data from EUVD (EUVD-2026-34609), which confirms the range as all Chrome builds preceding 149.0.7827.53 on Android.

RemediationAI

The vendor-released patch is Google Chrome for Android version 149.0.7827.53, documented in the stable channel update at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Android users should update Chrome via the Google Play Store immediately. For enterprise environments managing Android devices via MDM or Chrome Browser Cloud Management, push the update policy to enforce the minimum version of 149.0.7827.53. As a compensating control where immediate updates are not feasible, administrators may consider disabling the PaymentRequest API via Chrome enterprise policy (the 'DefaultPaymentHandlerScope' or equivalent policy flag), though this will break legitimate web-based payment flows and should be treated as a temporary measure only. Restricting navigation to untrusted external sites on managed Android devices reduces exposure to the crafted-HTML-page delivery vector. No additional vendor-confirmed workarounds are documented in the available advisory data.