What is the CVSS score of CVE-2026-11159?

CVE-2026-11159 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11159?

Yes, a patch is available for CVE-2026-11159. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11159

EUVD-2026-34620 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-06-04 chrome-cve-admin@google.com

GHSA-x6rc-7qvr-596r

Information Disclosure Google

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 18:51 vuln.today

CVSS changed

Jun 05, 2026 - 18:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 4.3

DescriptionCVE.org

Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's Skia graphics library affects all versions prior to 149.0.7827.53, exploitable via a crafted HTML page requiring only a single user visit. The root cause (CWE-457: use of uninitialized memory) in Chrome's Skia rendering backend allows residual memory contents to be exposed across origin boundaries, violating the browser's same-origin policy. No public exploit identified at time of analysis; EPSS at 0.03% (11th percentile) and absence from CISA KEV indicate low real-world exploitation probability at this time.

Technical ContextAI

Skia is Google's open-source 2D graphics library and serves as the primary rendering engine for Google Chrome across platforms. CWE-457 (Use of Uninitialized Variable) occurs when memory is allocated but not zeroed or populated before being read, allowing whatever residual data occupies that memory region to be accessed and potentially exposed. In a browser context, this is particularly sensitive because Skia processes rendering tasks across multiple tabs and origins; uninitialized buffers may contain fragments of data from other origin contexts, making this a same-origin policy bypass at the memory level. The vulnerability is triggered through crafted HTML that causes the Skia rendering pipeline to read from an uninitialized state. No CPE string was provided in the input data, but the affected product is confirmed as Google Chrome prior to version 149.0.7827.53 per EUVD-2026-34620.

RemediationAI

Vendor-released patch: Chrome 149.0.7827.53. Update Google Chrome to version 149.0.7827.53 or later via the browser's built-in updater or enterprise deployment tooling; the release details are documented at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and the upstream fix is tracked at https://issues.chromium.org/issues/501861921. Chrome typically auto-updates on consumer installations, but enterprise administrators should verify patch deployment via Google Admin Console or equivalent MDM solutions. As a compensating control pending update, restricting navigation to untrusted or unsolicited external URLs via web proxy filtering or browser isolation (e.g., Remote Browser Isolation) reduces exposure without impacting internal productivity; note that full JavaScript blocking would prevent exploitation but would break most web applications. No patch version other than 149.0.7827.53 was confirmed in the available data - do not assume earlier sub-releases are sufficient.