What is the CVSS score of CVE-2026-11153?

CVE-2026-11153 has a contested CVSS base score of 9.1 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11153?

Google Chrome versions prior to 149.0.7827.53 contain a critical cross-origin information disclosure vulnerability (CVSS 9.1) that could expose sensitive user data from legitimate websites accessed…. A patch is available.

How to fix or mitigate CVE-2026-11153?

Within 24 hours: Identify all Chrome installations across endpoints via MDM or asset management system and verify versions below 149.0.7827.53. Within 7 days: Deploy Chrome version 149.0.7827.53 or later to all affected endpoints; enable auto-update if not already configured. Within 30 days: Audit compliance to confirm 100% of Chrome installations are patched and auto-update is enabled.

Google Chrome CVE-2026-11153

EUVD-2026-34614 CRITICAL

Improper Protection of Physical Side Channels (CWE-1300)

2026-06-04 chrome-cve-admin@google.com

GHSA-h3j8-q3mw-gx7j

Information Disclosure Google Chrome

Critical

Disputed · 9.1 NVD

Severity by source

Sources disagree (Medium–Critical)

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SUSE

CRITICAL

qualitative

Red Hat

6.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 18:26 vuln.today

CVSS changed

Jun 05, 2026 - 18:22 NVD

9.1 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

CRITICAL 9.1

DescriptionCVE.org

Side-channel information leakage in Forms in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin information disclosure in Google Chrome's Forms component prior to version 149.0.7827.53 allows a remote attacker to leak sensitive data from other origins through a crafted HTML page. The flaw is rated CVSS 9.1 due to high confidentiality and integrity impact over the network without authentication, though Google's Chromium team internally rated it Medium severity. No public exploit identified at time of analysis and EPSS exploitation probability is very low (0.03%, 11th percentile).

Technical ContextAI

The vulnerability resides in Chrome's Forms implementation and is classified as CWE-1300 (Improper Protection of Physical Side Channels), indicating that observable behavior - likely timing, resource usage, or rendering side effects - leaks information across the Same-Origin Policy boundary. Chrome's Forms subsystem handles HTML form rendering, autofill, and submission across frames; a side-channel here can expose data that should be isolated by origin, undermining one of the browser's core security guarantees. The affected component is the Chromium-based Chrome desktop browser, with the fix landing in Stable Channel build 149.0.7827.53.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 (Stable Channel) - update immediately via Chrome's built-in updater (chrome://settings/help) or by deploying the latest MSI/PKG to managed fleets. Enterprises using Chrome Browser Cloud Management or group policy should verify the AutoUpdate channel is enabled and audit version compliance through chrome://policy. No workarounds are documented in the advisory; if patching is delayed, compensating controls are limited but include restricting browsing to trusted sites via URL allow-lists (high usability cost) or temporarily switching sensitive workflows to an alternate browser, though Chromium-based forks may share the defect until they rebase. Consult the official advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for any subsequent guidance.