What is the CVSS score of CVE-2026-11161?

CVE-2026-11161 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11161?

Yes, a patch is available for CVE-2026-11161. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11161

EUVD-2026-34622 MEDIUM

Origin Validation Error (CWE-346)

2026-06-04 chrome-cve-admin@google.com

GHSA-qrq7-gpw3-h474

Information Disclosure Google Chrome

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

7.4 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 18:52 vuln.today

CVSS changed

Jun 05, 2026 - 18:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in DataTransfer in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's DataTransfer API allows unauthenticated remote attackers to read data across origins by directing a victim to a crafted HTML page, affecting all Chrome desktop versions prior to 149.0.7827.53. The CVSS vector (AV:N/AC:L/PR:N/UI:R/C:L) confirms network accessibility without attacker authentication, but requires user interaction and yields only limited confidentiality impact with no integrity or availability consequences. No active exploitation is confirmed (not in CISA KEV), and EPSS at 0.03% (11th percentile) consistently signals low current exploitation probability.

Technical ContextAI

The vulnerability is rooted in CWE-346 (Origin Validation Error) within Chrome's DataTransfer interface - the browser API underpinning drag-and-drop and clipboard operations that facilitates data exchange between browser contexts and web origins. An inappropriate implementation in this subsystem failed to properly enforce same-origin policy boundaries, allowing data from one origin to be accessed or observed by a script operating under a different origin. Affected product is confirmed as Google Chrome (desktop) prior to version 149.0.7827.53 per ENISA EUVD-2026-34622 and the NVD CPE-implied scope. As a Chromium-engine flaw, the defect resides in the browser's renderer-level data isolation layer. The Chromium issue tracker reference (issues.chromium.org/issues/501920294) likely contains additional technical detail but may be access-restricted pending patch propagation.

RemediationAI

Update Google Chrome to version 149.0.7827.53 or later; this is the vendor-released patch confirmed by the Google stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome's automatic update mechanism handles this for most users - verify the installed version via chrome://settings/help and confirm it reflects 149.0.7827.53 or above. For managed enterprise environments, deploy the update through your patch management tooling (Google Admin, SCCM, Intune) prioritizing internet-facing or high-sensitivity user populations. If immediate upgrade is operationally blocked, compensating controls include enforcing browser isolation (e.g., Microsoft Defender Application Guard for Edge, containerized browser sessions) to limit cross-origin data exposure - note these introduce usability friction and do not address the underlying flaw. Restricting access to arbitrary external URLs via web proxy allowlisting reduces phishing-vector exposure but is impractical in general-purpose browsing environments.