What is the CVSS score of CVE-2026-11175?

CVE-2026-11175 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-11175?

Google Chrome for Android (prior to version 149.0.7827.53) is vulnerable to UI spoofing that could deceive users into compromising credentials or sensitive data.. A patch is available.

How to fix or mitigate CVE-2026-11175?

Within 24 hours: identify Chrome for Android deployment scope and current version inventory across your organization. Within 7 days: deploy Chrome for Android 149.0.7827.53 or later to all managed devices. Within 30 days: audit patch deployment compliance and monitor endpoint logs for exploitation attempts.

Google Chrome CVE-2026-11175

EUVD-2026-34636 HIGH

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-04 chrome-cve-admin@google.com

GHSA-hhhm-8p4x-8gm9

Information Disclosure Google

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

4.3 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 18:31 vuln.today

CVSS changed

Jun 05, 2026 - 18:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Incorrect security UI in Messages in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing in Google Chrome for Android prior to 149.0.7827.53 allows remote attackers to deceive users via crafted HTML pages that abuse the Messages component's security UI. Exploitation requires user interaction with a malicious page, and no public exploit has been identified at time of analysis. Despite a CVSS score of 8.8, EPSS exploitation probability is very low (0.03%, 11th percentile) and the issue is rated Medium by Chromium's own severity scale.

Technical ContextAI

The flaw resides in the Messages subsystem of Chrome on Android, which renders security-relevant interstitial or notification UI to the user. CWE-451 (User Interface Misrepresentation of Critical Information) describes a class of bugs where attacker-controlled content can overlay, mimic, or obscure trust-decision UI such as origin indicators, permission prompts, or warning dialogs. By delivering a crafted HTML page, the attacker can manipulate what the user sees in the Messages UI, breaking the chain of trust between the browser chrome and the underlying page origin. The affected component is specific to the Android port of Chromium and does not appear to apply to desktop builds.

RemediationAI

Vendor-released patch: Chrome for Android 149.0.7827.53. Update Chrome via the Google Play Store on all managed Android endpoints; in enterprise MDM environments, push the updated APK or enforce minimum-version policy via Android Enterprise managed configurations. Consult the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for rollout notes. No specific workaround is documented; as a compensating control until patching completes, restrict Chrome on Android to known-good sites via DNS or proxy filtering and reinforce user awareness training on URL-bar and permission-prompt scrutiny, accepting that user-vigilance controls are unreliable against UI-spoofing bugs by definition. For downstream Chromium-based Android browsers, monitor their respective release channels for the corresponding cherry-pick.