What is the CVSS score of CVE-2026-11156?

CVE-2026-11156 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11156?

Yes, a patch is available for CVE-2026-11156. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11156

EUVD-2026-34617 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-04 chrome-cve-admin@google.com

GHSA-g4qr-96mv-425v

Google CSRF

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 18:50 vuln.today

CVSS changed

Jun 05, 2026 - 18:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome prior to 149.0.7827.53 allows a remote unauthenticated attacker to read sensitive cross-origin data by luring a user to a crafted HTML page that exploits an inappropriate CSS implementation. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network-exploitable, no-privilege-required exploitation with a single user interaction as the only barrier. No public exploit has been identified and EPSS sits at 0.03% (11th percentile), indicating low current exploitation interest despite the low attack complexity.

Technical ContextAI

The flaw resides in Google Chrome's CSS subsystem, where an inappropriate implementation permits cross-origin data to be inferred or read through a specially crafted HTML page. CSS-based cross-origin leaks typically exploit browser behaviors such as CSS selector matching against cross-origin content, @import side-channels, or rendering timing discrepancies to exfiltrate information that the Same-Origin Policy is meant to protect. The assigned CWE-352 (Cross-Site Request Forgery) is notable and potentially imprecise for a data-leak class bug; CWE-352 classically covers forged state-changing requests, while the described impact is purely confidentiality-focused (C:L/I:N). This mapping inconsistency may reflect the CSS mechanism acting as a cross-origin request vehicle, but the root cause is more accurately characterized as a Same-Origin Policy bypass or information disclosure in the CSS engine. Affected product per EUVD CPE data: Google Chrome versions below 149.0.7827.53 across all supported desktop platforms.

RemediationAI

The primary fix is to update Google Chrome to version 149.0.7827.53 or later, which was confirmed by Google's Stable Channel Update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome typically auto-updates, but administrators managing enterprise fleets should verify deployment via policy and confirm the installed version is at or above 149.0.7827.53. If immediate patching is not possible, a compensating control is to restrict browser access to untrusted or externally-hosted HTML pages through web filtering or content security policies at the network perimeter - this reduces the UI:R exploitation opportunity. Note that blocking access to external URLs is operationally disruptive and not a sustainable long-term mitigation; patching remains the definitive fix. No workaround for the underlying CSS implementation flaw is available without the vendor patch.