What is the CVSS score of CVE-2026-11215?

CVE-2026-11215 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11215?

Yes, a patch is available for CVE-2026-11215. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11215

EUVD-2026-34676 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-04 chrome-cve-admin@google.com

GHSA-8wjg-7m7j-m4vh

Information Disclosure Google Red Hat Suse Chrome

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 15:26 vuln.today

CVSS changed

Jun 05, 2026 - 15:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

DescriptionCVE.org

Inappropriate implementation in Cronet in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofing via a crafted domain name. (Chromium security severity: Medium)

AnalysisAI

Domain spoofing in Google Chrome's Cronet networking library on Android (versions prior to 149.0.7827.53) enables remote unauthenticated attackers to misrepresent domain names to victims browsing on Android devices. The CVSS vector (AV:N/AC:L/PR:N/UI:R/I:H) confirms high integrity impact with no privileges required, contingent on victim interaction with a crafted URL. EPSS at 0.03% (11th percentile) and no CISA KEV listing indicate no public exploitation at time of analysis, making this primarily a targeted phishing-enablement risk rather than an actively weaponized vector.

Technical ContextAI

Cronet is Google's open-source networking library derived from the Chromium stack and embedded in Chrome for Android, handling HTTP/HTTPS request processing including URL parsing and domain resolution. CWE-451 (User Interface Misrepresentation of Critical Information) identifies the root cause as a failure to correctly normalize or validate domain names before rendering them in the browser's address bar, allowing a specially crafted domain string to display deceptively. This is consistent with known attack classes such as Unicode homograph abuse, bidirectional text injection, or IDN (Internationalized Domain Names) parsing inconsistencies within Cronet's implementation. The flaw is scoped exclusively to the Android build of Chrome - desktop Chrome and other Android browsers using independent networking stacks are not confirmed affected. Chromium classified this as Medium severity, consistent with the CVSS 6.5 score.

RemediationAI

Update Google Chrome on Android to version 149.0.7827.53 or later, which contains the vendor-released patch per the stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Enterprise and MDM-managed Android fleets should enforce this Chrome version via policy (e.g., Google Mobile Management or equivalent) to ensure broad coverage, since end-user auto-update cadence on Android can lag. No documented in-product workaround exists that disables Cronet without breaking Chrome's networking functionality, so patching is the only reliable remediation. As a compensating control until patching is confirmed, organizations with high-risk user populations (finance, healthcare, executive staff) may consider deploying URL-filtering proxies or DNS-layer controls that block newly registered or suspicious domain patterns - note this adds operational overhead and will not prevent all crafted domains from reaching users.