What is the CVSS score of CVE-2026-11199?

CVE-2026-11199 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11199?

Yes, a patch is available for CVE-2026-11199. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11199

EUVD-2026-34660 MEDIUM

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-h87w-chjg-gcc2

Information Disclosure Google

5.9

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

SUSE

5.7 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Jun 06, 2026 - 13:22 NVD

5.7 (MEDIUM) 5.9 (MEDIUM)

Analysis Generated

Jun 05, 2026 - 16:34 vuln.today

CVSS changed

Jun 05, 2026 - 16:22 NVD

5.7 (None) 5.7 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 5.7

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in WebRTC in Google Chrome prior to 149.0.7827.53 allowed an attacker in a privileged network position to leak cross-origin data via malicious network traffic. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's WebRTC implementation allows a network-positioned attacker to extract sensitive cross-origin information via crafted malicious network traffic. Affected versions are all Chrome releases prior to 149.0.7827.53; the fix is available in the stable channel update. No public exploit exists and no active exploitation has been identified - EPSS sits at 0.02% (4th percentile) and CISA SSVC assesses exploitation as none and automation as not feasible, placing real-world urgency well below the raw CVSS confidentiality impact suggests.

Technical ContextAI

WebRTC (Web Real-Time Communication) is a browser-native API and protocol stack enabling peer-to-peer audio, video, and data channels directly within the browser, relying on protocols such as DTLS, ICE, and SRTP. The flaw is classified under CWE-20 (Improper Input Validation), meaning Chrome's WebRTC subsystem fails to adequately validate or sanitize network-supplied data, allowing it to be used as a channel for cross-origin data extraction - a violation of the Same-Origin Policy that browsers are designed to enforce. The affected CPE, inferred from EUVD data, covers Google Chrome versions below 149.0.7827.53 on desktop platforms. The 'inappropriate implementation' phrasing used by Google typically indicates a logic or design-level flaw rather than a classic memory-safety issue.

RemediationAI

The primary fix is to update Google Chrome to version 149.0.7827.53 or later, released via the stable channel update documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Enterprise administrators managing Chrome fleet deployments should push this update through their endpoint management tooling immediately, prioritizing systems used on untrusted or shared networks. As a compensating control for environments that cannot patch immediately, restricting or disabling WebRTC in Chrome via policy (setting WebRtcAllowed to false in Chrome enterprise policy, or using extensions that block WebRTC) would eliminate the attack surface at the cost of breaking any WebRTC-dependent functionality such as browser-based video conferencing or VoIP tools. Ensuring users are not operating on untrusted network segments (e.g., public Wi-Fi) also reduces exploitation feasibility given the network-position prerequisite.