What is the CVSS score of CVE-2026-11179?

CVE-2026-11179 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-11179?

Google Chrome versions before 149.0.7827.53 contain a site isolation bypass vulnerability (CVSS 8.8) that could allow attackers to circumvent the browser's core security boundary separating different…. A patch is available.

How to fix or mitigate CVE-2026-11179?

Within 24 hours: Assess Chrome deployment scope and notify security and user-facing teams. Within 7 days: Deploy Chrome 149.0.7827.53 or later via your standard patch management process and enable automatic updates if not already configured. Within 30 days: Audit endpoint patch compliance and document remediation metrics.

Google Chrome CVE-2026-11179

EUVD-2026-34640 HIGH

Improper Access Control (CWE-284)

2026-06-04 chrome-cve-admin@google.com

GHSA-2vhv-47fq-657f

Authentication Bypass Google Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.2 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 17:27 vuln.today

CVSS changed

Jun 05, 2026 - 17:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Inappropriate implementation in ORB in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Site isolation bypass in Google Chrome versions prior to 149.0.7827.53 allows remote attackers to circumvent a core browser security boundary via a crafted HTML page. The flaw resides in the Opaque Response Blocking (ORB) implementation and requires user interaction (visiting a malicious page), with no public exploit identified at time of analysis and an EPSS score of 0.02% indicating low near-term exploitation likelihood.

Technical ContextAI

The vulnerability lies in Chromium's Opaque Response Blocking (ORB), a defense mechanism that works alongside Site Isolation to prevent cross-origin data leaks by blocking responses with mismatched MIME types from being delivered to incompatible request contexts. Site Isolation places documents from different sites into separate renderer processes to protect against Spectre-class side-channel attacks and cross-origin data theft. CWE-284 (Improper Access Control) maps to the root cause: ORB's filtering logic inappropriately permits responses that should have been blocked, weakening the isolation boundary that protects sensitive cross-origin resources from a malicious renderer.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 or later - upgrade immediately via the standard Chrome auto-update mechanism or by relaunching the browser after Help → About Google Chrome triggers an update check. Enterprise administrators using managed deployments should push the updated MSI/PKG through their distribution channels and verify rollout via the Chrome Enterprise update reporting. Users of Chromium-based derivatives (Edge, Brave, Opera, Vivaldi) should monitor their respective vendors for downstream releases incorporating this fix. As a temporary compensating control before patching, restrict browsing to trusted sites or deploy a web filter to limit attacker-controlled content delivery, accepting the trade-off of reduced general browsing utility; full advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html.