What is the CVSS score of CVE-2026-11187?

CVE-2026-11187 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11187?

Yes, a patch is available for CVE-2026-11187. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11187

EUVD-2026-34648 MEDIUM

Improper Access Control (CWE-284)

2026-06-04 chrome-cve-admin@google.com

GHSA-rr2q-vq95-j9p2

Authentication Bypass Google Red Hat Suse Chrome

6.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

SUSE

MEDIUM

qualitative

Red Hat

5.4 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 13:27 vuln.today

CVSS changed

Jun 05, 2026 - 13:22 NVD

6.3 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.3

DescriptionCVE.org

Inappropriate implementation in Glic in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Navigation restriction bypass in Google Chrome's Glic component (versions prior to 149.0.7827.53) enables remote attackers to circumvent browser navigation controls by delivering a crafted HTML page that the victim must open. The vulnerability is rooted in an inappropriate implementation (CWE-284, Improper Access Control) within the Glic subsystem and yields limited but multi-dimensional impact across confidentiality, integrity, and availability (C:L/I:L/A:L). No public exploit identified at time of analysis and this CVE does not appear in CISA KEV; Google has assigned a 'Medium' severity rating consistent with the CVSS 6.3 score.

Technical ContextAI

Glic is a Google Chrome component involved in page rendering or navigation policy enforcement; the exact internal role is not fully disclosed in public documentation, but the vulnerability class (CWE-284, Improper Access Control) indicates that access control logic within Glic fails to correctly enforce navigation restrictions under specific crafted-page conditions. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U) confirms network-reachable exploitation with no privileges required, though user interaction (opening a crafted HTML page) is mandatory. The unchanged scope (S:U) indicates the compromise is contained within the browser's security context and does not directly break out to the underlying OS. Affected CPE aligns to Chrome versions below 149.0.7827.53 on desktop platforms, as confirmed by EUVD-2026-34648.

RemediationAI

Upgrade Google Chrome to version 149.0.7827.53 or later, which contains the vendor-released fix as announced in the stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome typically auto-updates on supported platforms; administrators managing enterprise deployments should verify the installed version via policy tooling and force an update cycle. If immediate patching is not feasible, configuring browser enterprise policies to restrict navigation to trusted internal URLs can reduce exposure surface, though this may impair user workflows. Blocking untrusted or external HTML content delivery through web proxies is a secondary compensating control, with the trade-off of added operational complexity. The Chromium issue tracker entry (https://issues.chromium.org/issues/502819675) may contain additional technical detail once the embargo is lifted.