What is the CVSS score of CVE-2026-11162?

CVE-2026-11162 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11162?

Yes, a patch is available for CVE-2026-11162. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11162

EUVD-2026-34623 MEDIUM

Information Exposure (CWE-200)

2026-06-04 chrome-cve-admin@google.com

GHSA-h85h-h6g3-mvgv

Information Disclosure Google

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

7.4 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 18:53 vuln.today

CVSS changed

Jun 05, 2026 - 18:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's CSS implementation exposes sensitive information from other origins when a user visits a crafted HTML page. Affected are all Chrome versions prior to 149.0.7827.53 on desktop platforms. An unauthenticated remote attacker can exploit this to read data from cross-origin contexts, violating the browser's Same-Origin Policy via a CSS-based side channel or direct information disclosure path. No public exploit identified at time of analysis, and EPSS at 0.03% (11th percentile) signals low current exploitation activity.

Technical ContextAI

The vulnerability resides in Chromium's CSS rendering subsystem, which implements styling and layout calculations that interact with cross-origin resources in the browser's rendering pipeline. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) identifies the root cause class: an implementation flaw in how CSS processes or exposes resource information permits leaking data that should be isolated by the Same-Origin Policy. CSS-based cross-origin leaks often exploit timing side channels (e.g., computed style queries that reveal whether cross-origin content loaded) or direct spec non-compliance in property resolution. The affected product is identified as Google Chrome (Chromium-based) for desktop prior to version 149.0.7827.53, per the EUVD affected version range 'Chrome 149.0.7827.53 < 149.0.7827.53' and Google's stable channel release advisory.

RemediationAI

The primary fix is to upgrade Google Chrome to version 149.0.7827.53 or later. This is confirmed as a vendor-released patch per the stable channel update advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism will deliver this update on most endpoints; administrators managing enterprise fleets should verify update policy compliance and push the update via Chrome Browser Cloud Management or equivalent MDM. If immediate upgrade is operationally blocked, a compensating control is to enforce strict Content-Security-Policy headers on sensitive web applications to reduce the utility of cross-origin data leakage - note this mitigates attacker value rather than the browser flaw itself. Browser isolation technologies (e.g., Site Isolation, which should already be enabled by default in Chrome) also limit the blast radius of cross-origin leaks but do not eliminate this specific CSS-layer vulnerability.