What is the CVSS score of CVE-2026-11203?

CVE-2026-11203 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11203?

Yes, a patch is available for CVE-2026-11203. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11203

EUVD-2026-34664 MEDIUM

Information Exposure (CWE-200)

2026-06-04 chrome-cve-admin@google.com

GHSA-793m-2h6c-59w8

Information Disclosure Google

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

7.4 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 16:35 vuln.today

CVSS changed

Jun 05, 2026 - 16:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in GPU in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's GPU implementation on macOS allows remote unauthenticated attackers to exfiltrate sensitive cross-origin information by luring a user to a crafted HTML page. Affected are all Chrome releases on Mac prior to 149.0.7827.53. The vulnerability stems from an inappropriate GPU implementation (CWE-200) and carries no publicly available exploit at time of analysis; EPSS sits at 0.03% (11th percentile), indicating low current exploitation probability. No active exploitation has been confirmed by CISA KEV.

Technical ContextAI

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), arising from an inappropriate implementation within Chrome's GPU rendering pipeline specifically on macOS. The GPU subsystem is responsible for compositing and rendering web content, including cross-origin iframes and resources. When rendering a crafted HTML page, the GPU layer improperly handles cross-origin content in a way that allows pixel or data-level information from one origin to be observed by a script or resource from a different origin, violating the Same-Origin Policy enforced at the browser level. This class of vulnerability - sometimes called a side-channel or rendering leak - typically exploits subtle differences in how GPU memory, textures, or compositing state are shared or isolated between renderer processes. The affected product is Google Chrome on macOS, all versions prior to 149.0.7827.53, as confirmed by EUVD-2026-34664 and the Chrome stable channel release advisory.

RemediationAI

Update Google Chrome on macOS to version 149.0.7827.53 or later - this is the vendor-confirmed patched release per the Chrome Stable Channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome typically auto-updates, but administrators managing enterprise fleets should push the update via Chrome Browser Cloud Management or policy to ensure prompt deployment. As a workaround pending update, restricting access to untrusted or unknown websites via content filtering or DNS-based controls would reduce exposure, though this carries usability trade-offs. Disabling GPU acceleration in Chrome (chrome://settings → System → 'Use graphics acceleration when available') would likely eliminate the vulnerable code path as a temporary compensating control, at the cost of degraded rendering performance and potential site compatibility issues. This control should only be treated as a short-term measure while patching is completed.