What is the CVSS score of CVE-2026-11169?

CVE-2026-11169 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-11169?

A high-severity universal cross-site scripting vulnerability in Google Chrome (prior to version 149.0.7827.53) allows attackers to inject malicious code across website security boundaries,…. A patch is available.

How to fix or mitigate CVE-2026-11169?

Within 24 hours: Identify all Chrome deployment methods (managed clients, personal devices, web services) and current version inventory. Within 7 days: Deploy Chrome version 149.0.7827.53 or later across all Windows, macOS, and Linux systems using your standard update deployment tools; prioritize systems with access to sensitive applications. Within 30 days: Verify 100% patch compliance through device inventory and automated scanning; generate remediation report for any non-compliant systems.

Google Chrome CVE-2026-11169

EUVD-2026-34630 HIGH

XML Injection (aka Blind XPath Injection) (CWE-91)

2026-06-04 chrome-cve-admin@google.com

GHSA-6v78-5565-q7f5

Google Code Injection

8.1

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

SUSE

HIGH

qualitative

Red Hat

8.1 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 18:29 vuln.today

CVSS changed

Jun 05, 2026 - 18:22 NVD

8.1 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.1

DescriptionCVE.org

Inappropriate implementation in XML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted XML file. (Chromium security severity: Medium)

AnalysisAI

Universal cross-site scripting (UXSS) in Google Chrome versions prior to 149.0.7827.53 allows a remote attacker to inject arbitrary scripts or HTML into the context of other origins via a crafted XML file. The flaw stems from an inappropriate implementation in Chrome's XML handling (CWE-91, XML Injection), enabling same-origin policy bypass when a user is lured into loading attacker-controlled content. No public exploit has been identified at time of analysis, and EPSS exploitation probability is low at 0.06% (18th percentile).

Technical ContextAI

The vulnerability resides in Chrome's XML processing pipeline within the Blink rendering engine, where input is parsed and rendered as part of XML documents (e.g., XHTML, SVG, or generic application/xml content). CWE-91 (XML Injection / Improper Neutralization of Special Elements used in an XML Expression) indicates that attacker-supplied content is interpolated into XML structures without sufficient encoding, permitting injected markup or script to be reinterpreted by the browser's renderer. Because the flaw enables Universal XSS (UXSS), the injection executes in the security context of a victim origin rather than the attacker's, defeating same-origin policy protections. CPE data is not provided in the input, but the EUVD record narrows the affected scope to Chrome versions below 149.0.7827.53 across desktop platforms covered by the Stable channel update.

RemediationAI

Upgrade Google Chrome to version 149.0.7827.53 or later on all desktop platforms - this is the vendor-released patch confirmed by the Chrome Releases blog (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html) and tracked in Chromium issue 502285273. Enterprises managing Chrome via group policy or MDM should force-update fleets and verify the version through chrome://settings/help; users of Chromium-derived browsers (Edge, Brave, Opera, Vivaldi) should apply their respective vendor updates once available since those projects rebase on Chromium. As a compensating control until patching completes, restrict navigation to untrusted XML/XHTML content by enforcing strict Content Security Policy on internal applications and blocking direct user navigation to attacker-supplied .xml/.xhtml/.svg URLs at the web proxy - note that proxy-based blocking of XML content types may break legitimate SaaS applications that serve XML to the browser, so scope the rules narrowly.