What is the CVSS score of CVE-2026-11175?

CVE-2026-11175 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-11175?

Google Chrome for Android (prior to version 149.0.7827.53) is vulnerable to UI spoofing that could deceive users into compromising credentials or sensitive data.. A patch is available.

How to fix or mitigate CVE-2026-11175?

Within 24 hours: identify Chrome for Android deployment scope and current version inventory across your organization. Within 7 days: deploy Chrome for Android 149.0.7827.53 or later to all managed devices. Within 30 days: audit patch deployment compliance and monitor endpoint logs for exploitation attempts.

Google Chrome CVE-2026-11175

EUVD-2026-34636 HIGH

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-04 chrome-cve-admin@google.com

GHSA-hhhm-8p4x-8gm9

Information Disclosure Chrome Google

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

4.3 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 18:31 vuln.today

CVSS changed

Jun 05, 2026 - 18:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Incorrect security UI in Messages in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing in Google Chrome for Android prior to 149.0.7827.53 allows remote attackers to deceive users via crafted HTML pages that abuse the Messages component's security UI. Exploitation requires user interaction with a malicious page, and no public exploit has been identified at time of analysis. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Attacker crafts malicious HTML page

Delivery

Lure Android Chrome user via phishing or redirect

Exploit

Victim loads page in vulnerable Chrome

Execution

Page manipulates Messages security UI

Persist

User trusts spoofed indicator

Impact

Credential theft or unauthorized permission grant

Access

Attacker crafts malicious HTML page

Delivery

Lure Android Chrome user via phishing or redirect

Exploit

Victim loads page in vulnerable Chrome

Execution

Page manipulates Messages security UI

Persist

User trusts spoofed indicator

Impact

Credential theft or unauthorized permission grant

Vulnerability AssessmentAI

Exploitation	Victim must use Google Chrome on Android at a version below 149.0.7827.53 and must actively navigate to or be redirected to the attacker-controlled HTML page (UI:R in the CVSS vector confirms required user interaction). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Signals here conflict and require careful weighting. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts a malicious site and lures an Android Chrome user via phishing link, ad redirect, or compromised legitimate site. When the victim loads the crafted HTML page, the page manipulates Chrome's Messages UI to display misleading security indicators - for example, presenting a fake permission prompt, spoofed origin, or counterfeit security warning - that trick the user into granting access, entering credentials, or trusting attacker-controlled content as if it came from a legitimate source. …
Remediation	Vendor-released patch: Chrome for Android 149.0.7827.53. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: identify Chrome for Android deployment scope and current version inventory across your organization. …

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Chrome

View all

CVE-2026-3910 HIGH Act Now POC

8.8 Mar 13

Chrome's V8 JavaScript engine contains an inappropriate implementation (CVE-2026-3910, CVSS 8.8) that allows remote atta

CVE-2026-3909 HIGH Act Now POC

8.8 Mar 13

Google Chrome's Skia graphics library contains an out-of-bounds write (CVE-2026-3909, CVSS 8.8) enabling remote attacker

CVE-2026-5281 HIGH Act Now POC

8.8 Apr 01

Remote code execution in Google Chrome prior to version 146.0.7680.178 via a use-after-free vulnerability in the Dawn gr

CVE-2025-5419 HIGH Act Now POC

8.8 Jun 03

Chrome's V8 JavaScript engine contains an out-of-bounds read and write vulnerability (CVE-2025-5419, CVSS 8.8) enabling

CVE-2026-2441 HIGH Act Now POC

8.8 Feb 13

Google Chrome's CSS engine contains a use-after-free vulnerability (CVE-2026-2441, CVSS 8.8) that allows remote attacker

CVE-2025-6554 HIGH Act Now POC

8.1 Jun 30

Chrome's V8 engine contains a type confusion vulnerability (CVE-2025-6554, CVSS 8.1) enabling arbitrary read/write opera

CVE-2025-13223 HIGH Act Now

8.8 Nov 17

Google Chrome V8 contains a type confusion vulnerability in the JavaScript engine, the second V8 type confusion zero-day

CVE-2025-27038 HIGH Act Now

7.5 Jun 03

Qualcomm Adreno GPU drivers in Chrome contain a use-after-free vulnerability (CVE-2025-27038, CVSS 7.5) enabling memory

CVE-2024-12450 CRITICAL Act Now POC

9.8 Mar 20

In infiniflow/ragflow versions 0.12.0, the `web_crawl` function in `document_app.py` contains multiple vulnerabilities.

CVE-2025-6179 CRITICAL Act Now POC

9.8 Jun 16

Critical permissions bypass vulnerability in Google Chrome OS 16181.27.0 that allows local attackers to disable extensio

CVE-2025-49713 HIGH This Week POC

8.8 Jul 02

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized

CVE-2025-2073 HIGH This Week POC

8.8 Apr 16

Out-of-Bounds Read in netfilter/ipset in Linux Kernel ChromeOS [6.1, 5.15, 5.10, 5.4, 4.19] allows a local attacker with

Same weakness CWE-451 – User Interface (UI) Misrepresentation of Critical Information

View all

CVE-2025-8043 CRITICAL POC

9.8

CVE-2025-7021 MEDIUM POC

6.5

CVE-2026-0907 CRITICAL

9.8

CVE-2026-0906 CRITICAL

9.8

CVE-2026-2634 CRITICAL

9.8

CVE-2025-68277 MEDIUM POC

5.0

CVE-2026-11172 HIGH

8.8

CVE-2026-53829 HIGH

8.5

Same technique Information Disclosure

View all

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2014-6324 HIGH POC

8.8

CVE-2017-0213 HIGH POC

7.3

CVE-2016-7255 HIGH POC

7.8

CVE-2010-0232 HIGH POC

7.8

CVE-2025-30066 HIGH POC

8.6

CVE-2025-54236 CRITICAL POC

9.1

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Package Hub 15 SP7	Fixed
openSUSE Leap 16.0	Fixed
openSUSE Tumbleweed	Fixed
SUSE Package Hub 15 SP7	Affected

CVE-2026-11175 vulnerability details – vuln.today

Back

Google Chrome CVE-2026-11175

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

More in Chrome

Same weakness CWE-451 – User Interface (UI) Misrepresentation of Critical Information

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code