What is the CVSS score of CVE-2026-11206?

CVE-2026-11206 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11206?

Yes, a patch is available for CVE-2026-11206. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11206

EUVD-2026-34667 MEDIUM

Protection Mechanism Failure (CWE-693)

2026-06-04 chrome-cve-admin@google.com

GHSA-f5rp-j8px-phpc

Information Disclosure Google

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 16:36 vuln.today

CVSS changed

Jun 05, 2026 - 16:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in ServiceWorker in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage via ServiceWorker policy bypass in Google Chrome affects all desktop versions prior to 149.0.7827.53. Insufficient policy enforcement in Chrome's ServiceWorker API allows unauthenticated remote attackers to read sensitive cross-origin data from a victim's browser session by directing the victim to a crafted HTML page. EPSS exploitation probability is very low at 0.03% (11th percentile), no public exploit code has been identified, and no CISA KEV listing exists at time of analysis - making this a moderate confidentiality risk that warrants patching but is not an immediate emergency for most organizations.

Technical ContextAI

ServiceWorker is a W3C-specified browser API that functions as a client-side programmable network proxy, intercepting and handling fetch requests between web pages and the network. It operates independently of the main browser thread and has access to the Cache API and background sync. The root cause is CWE-693 (Protection Mechanism Failure), meaning Chrome's enforcement of the same-origin policy - a core browser security boundary preventing one origin from reading data belonging to another - is insufficiently applied within the ServiceWorker execution context. A crafted ServiceWorker script can exploit this gap to observe or extract responses from cross-origin resources that should be opaque. The affected product is Google Chrome for desktop, all versions prior to 149.0.7827.53, as confirmed by EUVD-2026-34667 and the Chrome stable channel advisory.

RemediationAI

The primary fix is upgrading Google Chrome to version 149.0.7827.53 or later, as released via the Chrome stable channel and documented at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism will apply this for most end-users automatically; enterprise administrators managing Chrome via policy (e.g., Google Admin Console or WSUS equivalents) should verify fleet-wide version compliance using endpoint management tooling. No vendor-documented workarounds are available for this vulnerability. As a compensating control where immediate patching is infeasible, organizations could restrict access to untrusted or external web content via web filtering proxies, though this carries significant usability trade-offs. Disabling ServiceWorker APIs via enterprise policy (chrome://flags or ExtensionInstallBlocklist) is not a standard supported option and could break legitimate web applications.