What is the CVSS score of CVE-2026-11209?

CVE-2026-11209 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11209?

Yes, a patch is available for CVE-2026-11209. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11209

EUVD-2026-34670 MEDIUM

Information Exposure (CWE-200)

2026-06-04 chrome-cve-admin@google.com

GHSA-xmx7-whjx-vf2r

Information Disclosure Google Red Hat Suse Chrome

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

5.0 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 15:22 vuln.today

CVSS changed

Jun 05, 2026 - 15:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

DescriptionCVE.org

Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sensitive information disclosure in Google Chrome's Passwords component (prior to 149.0.7827.53) allows a remote attacker who has already compromised the renderer process to read potentially sensitive data - including password material - from process memory by delivering a crafted HTML page. The attack carries a CVSS 6.5 (Medium) rating with high confidentiality impact and no integrity or availability consequence. No public exploit has been identified at time of analysis, and EPSS places exploitation probability at 0.03% (11th percentile), consistent with the non-trivial prerequisite of prior renderer compromise.

Technical ContextAI

Google Chrome's multi-process architecture isolates web content inside sandboxed renderer processes, which are intentionally separated from the browser process that manages privileged data such as saved passwords. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) identifies the root cause class: an inappropriate implementation in the Passwords subsystem causes sensitive memory contents to be accessible from within the renderer process context when they should not be. This means that if the renderer isolation boundary is already breached - typically via a separate memory corruption or logic bug exploit - the Passwords component does not adequately protect its in-memory data from that compromised context. The affected codebase is confirmed as Chromium (reported via chrome-cve-admin@google.com), and the ENISA EUVD entry EUVD-2026-34670 corroborates the affected version range as all Chrome releases prior to 149.0.7827.53.

RemediationAI

The primary remediation is to update Google Chrome to version 149.0.7827.53 or later, which contains the vendor-released patch for this vulnerability. The update is available via Chrome's built-in auto-update mechanism or manually through the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Because exploitation requires prior renderer process compromise, organizations unable to patch immediately should prioritize mitigations that reduce the risk of renderer exploitation generally: enforcing Chrome's Site Isolation feature (enabled by default in modern Chrome but worth verifying in enterprise policy), disabling JavaScript from untrusted origins where feasible via enterprise policy (trade-off: significant usability impact), and ensuring Chrome's sandbox is not disabled by enterprise flags. Removing saved passwords from Chrome's built-in password manager and migrating to a dedicated password manager that does not store credentials in browser process memory is a compensating control with minimal usability trade-off but requires user behavior change.