What is the CVSS score of CVE-2026-11157?

CVE-2026-11157 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11157?

Yes, a patch is available for CVE-2026-11157. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11157

EUVD-2026-34618 MEDIUM

Code Injection (CWE-94)

2026-06-04 chrome-cve-admin@google.com

GHSA-mjcq-9w3f-v5mx

Code Injection Google RCE Chrome

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

7.9 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 18:51 vuln.today

CVSS changed

Jun 05, 2026 - 18:22 NVD

5.4 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 5.4

DescriptionCVE.org

Script injection in Accessibility in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to inject arbitrary scripts or HTML (UXSS) via a crafted Chrome Extension. (Chromium security severity: Medium)

AnalysisAI

Script injection via Chrome's Accessibility component allows a remote attacker who convinces a victim to install a malicious extension to perform Universal Cross-Site Scripting (UXSS), injecting arbitrary scripts or HTML into web page contexts the user visits. Affected are all Chrome desktop versions prior to 149.0.7827.53. EPSS is 0.01% (2nd percentile) and this vulnerability is not in CISA KEV, indicating very low real-world exploitation probability at time of analysis; however, the social-engineering prerequisite (malicious extension installation) remains a credible threat vector in targeted campaigns.

Technical ContextAI

The vulnerability is classified under CWE-94 (Improper Control of Generation of Code), indicating insufficient neutralization of user-controllable input before it is used to generate executable code or markup. The affected subsystem is Chrome's Accessibility layer, which provides assistive technology interfaces and deep DOM integration. A crafted Chrome Extension - which by design has elevated browser privileges - can exploit insufficient input sanitization in this Accessibility component to inject arbitrary scripts or HTML into the context of web pages, a technique known as UXSS. UXSS is particularly dangerous because it bypasses the Same-Origin Policy, allowing injected code to execute across multiple origins within the same browser session. Affected product per EUVD CPE data is Google Chrome on desktop prior to version 149.0.7827.53.

RemediationAI

The primary fix is upgrading Google Chrome to version 149.0.7827.53 or later, delivered via Google's stable channel update announced at chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Enterprise deployments should expedite rollout through Google Update or Chrome Browser Cloud Management. As a compensating control that directly addresses the attack prerequisite, organizations should enforce extension allowlisting policies using Chrome Enterprise group policy (ExtensionInstallAllowlist / ExtensionInstallBlocklist) to restrict installation to approved extensions only - this eliminates the malicious extension installation vector entirely without impacting browser functionality. Blocking extension installation from outside the Chrome Web Store (ExtensionInstallSources) is an additional layered control. Note that overly restrictive extension policies may impact productivity workflows; coordinate with end users and application owners before deploying.