What is the CVSS score of CVE-2026-11150?

CVE-2026-11150 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-11150?

Yes, a patch is available for CVE-2026-11150. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11150

EUVD-2026-34611 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-04 chrome-cve-admin@google.com

GHSA-vpv3-wprv-r8g5

XSS Google Chrome

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Red Hat

9.3 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 05:33 vuln.today

CVSS changed

Jun 06, 2026 - 05:22 NVD

6.1 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.1

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in XML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Universal Cross-Site Scripting (UXSS) in Google Chrome's XML processing component allows remote unauthenticated attackers to inject arbitrary scripts or HTML across origin boundaries by luring a victim to a crafted HTML page. All Chrome versions prior to 149.0.7827.53 are affected, with the Scope:Changed (S:C) CVSS vector confirming this vulnerability can bypass the Same-Origin Policy - the defining characteristic of UXSS. No public exploit code has been identified at time of analysis, and the EPSS score of 0.06% (18th percentile) reflects low observed exploitation probability, though UXSS primitives are historically attractive to threat actors targeting session data and credential theft at scale.

Technical ContextAI

The vulnerability stems from an inappropriate implementation within Chrome's XML processing subsystem (CWE-79: Improper Neutralization of Input During Web Page Generation). CWE-79 covers cases where user-controllable input is not properly sanitized before being rendered in a web context. What elevates this beyond a standard reflected XSS is its UXSS classification: the crafted HTML page manipulates Chrome's XML handling in a way that permits script injection to execute with privileges spanning multiple origins, not just the attacker's own domain. The CVSS Scope:Changed component (S:C) formally captures this cross-boundary impact. The Chromium issue tracker entry (issues.chromium.org/issues/501740299) is referenced but not publicly disclosed, consistent with Google's coordinated disclosure practice of restricting bug details until after patch deployment.

RemediationAI

The primary fix is upgrading Google Chrome to version 149.0.7827.53 or later via Google's stable channel update, confirmed available at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Enterprise administrators should push this update via Chrome Browser Cloud Management or Group Policy without delay, as browser updates are typically transparent to end users. If immediate patching is not feasible, consider enforcing a URL allowlist via enterprise policy (URLAllowlist/URLBlocklist) to restrict navigation to untrusted external sites, which reduces the attack surface but imposes usability constraints. Disabling JavaScript entirely via ContentSettings policy would block UXSS payload execution but would break most modern web applications and is not practical for general use. Chromium-based browser variants (Edge, Brave, Vivaldi) built on the same engine version may also be affected and should be verified against their respective vendor advisories independently, as those vendors maintain separate patch timelines.