What is the CVSS score of CVE-2026-11210?

CVE-2026-11210 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11210?

Yes, a patch is available for CVE-2026-11210. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11210

EUVD-2026-34671 MEDIUM

Improper Access Control (CWE-284)

2026-06-04 chrome-cve-admin@google.com

GHSA-c359-w8jq-qfwq

Authentication Bypass Google

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

SUSE

MEDIUM

qualitative

Red Hat

5.4 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 15:25 vuln.today

CVSS changed

Jun 05, 2026 - 15:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

DescriptionCVE.org

Inappropriate implementation in Safe Browsing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary access control via a crafted RAR file. (Chromium security severity: Medium)

AnalysisAI

Safe Browsing bypass in Google Chrome prior to 149.0.7827.53 allows a remote attacker to circumvent discretionary access control protections by delivering a specially crafted RAR file to a victim who interacts with it. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms no authentication or elevated privileges are required on the attacker side, but exploitation depends on user interaction - the victim must engage with the malicious RAR file. The integrity impact is rated High (I:H) with no confidentiality or availability impact, indicating the primary risk is bypassing file-based access controls enforced by the Safe Browsing subsystem. No public exploit identified at time of analysis, and EPSS at 0.02% (4th percentile) reflects very low observed exploitation probability.

Technical ContextAI

The vulnerability resides in Chrome's Safe Browsing subsystem, a security layer designed to warn users about or block potentially dangerous files, URLs, and downloads. CWE-284 (Improper Access Control) identifies the root cause as a failure to correctly enforce access control decisions - specifically, an 'inappropriate implementation' in how Safe Browsing processes or evaluates RAR archive files. RAR archives are container formats that can embed arbitrary content; a crafted RAR may exploit parsing edge cases, malformed headers, or nested structures to confuse the Safe Browsing engine into issuing an incorrect allow decision where it should block. Affected versions are confirmed as all Chrome releases prior to 149.0.7827.53 per the ENISA EUVD entry (EUVD-2026-34671) and the Google stable channel advisory.

RemediationAI

Update Google Chrome to version 149.0.7827.53 or later; this is the vendor-released patch confirmed by the stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome typically auto-updates, but administrators managing enterprise fleets should verify deployment via policy and confirm the version through chrome://settings/help. As a compensating control prior to patching, organizations may consider blocking RAR file downloads at the email gateway or web proxy layer - note this may disrupt legitimate use of compressed archives. Enabling Enhanced Safe Browsing mode in Chrome (Settings > Privacy and security > Security > Enhanced protection) may provide additional heuristic coverage, though it is not confirmed to mitigate this specific bypass. Do not rely on Safe Browsing alone as a file-vetting control until patched; pair with endpoint detection tools that inspect archive contents independently of Chrome.