What is the CVSS score of CVE-2026-11176?

CVE-2026-11176 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11176?

Yes, a patch is available for CVE-2026-11176. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11176

EUVD-2026-34637 MEDIUM

Origin Validation Error (CWE-346)

2026-06-04 chrome-cve-admin@google.com

GHSA-q86p-qvcq-mv9c

Information Disclosure Google

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

7.4 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 18:55 vuln.today

CVSS changed

Jun 05, 2026 - 18:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's Media subsystem (all versions prior to 149.0.7827.53) enables a remote attacker to read sensitive data from other web origins by inducing a user to visit a specially crafted HTML page. The flaw stems from an inappropriate implementation in Media that fails to correctly enforce origin boundaries (CWE-346), resulting in high confidentiality impact per CVSS (C:H) with no integrity or availability consequence. No active exploitation is confirmed - CISA KEV is absent and EPSS sits at 0.03% (11th percentile) - but the confidentiality vector is significant for users accessing sensitive cross-origin content concurrently.

Technical ContextAI

The vulnerability is rooted in CWE-346 (Origin Validation Error), a class of flaws where an implementation fails to properly enforce the Same-Origin Policy (SOP) - a foundational browser security boundary preventing scripts on one origin from reading data belonging to another. The affected component is Chrome's Media subsystem, which handles audio, video, and related resource processing. An inappropriate implementation in how this subsystem handles cross-origin media requests or resource responses apparently allows a crafted page to bypass SOP enforcement, enabling JavaScript on the attacker's origin to infer or directly read data from a distinct target origin. No CPE strings were supplied in the source data; affected scope is defined by vendor advisory and EUVD-2026-34637 as all Chrome versions in the range prior to 149.0.7827.53. The issue was reported via chrome-cve-admin@google.com and assigned Chromium severity Medium, consistent with the CVSS 6.5 Medium score.

RemediationAI

Update Google Chrome to version 149.0.7827.53 or later - this is the vendor-released patch confirmed by the stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism will deliver this for most consumer installations; enterprise administrators should verify deployment via Google's enterprise browser management tooling (Google Admin Console or Chrome Browser Cloud Management) and confirm version propagation. No workarounds are described in available references for this specific vulnerability. As a compensating control where immediate patching is operationally blocked, restricting users to approved site allowlists via enterprise browser policy (e.g., URLBlocklist) reduces exposure by limiting access to attacker-controlled pages, but this significantly constrains normal browsing and is not a substitute for patching. The Chromium issue tracker entry (https://issues.chromium.org/issues/502371717) may contain additional technical mitigation detail but may be access-restricted pending broader patch adoption.