What is the CVSS score of CVE-2026-11216?

CVE-2026-11216 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11216?

Yes, a patch is available for CVE-2026-11216. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11216

EUVD-2026-34677 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-04 chrome-cve-admin@google.com

GHSA-pmhg-cprx-7ppp

Information Disclosure Google Red Hat Suse Chrome

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 15:27 vuln.today

CVSS changed

Jun 05, 2026 - 15:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 4.3

DescriptionCVE.org

Incorrect security UI in File Input in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome's File Input component (versions prior to 149.0.7827.53) enables remote attackers to misrepresent security-critical interface elements to users through specially crafted HTML pages. The attacker must convince a target to perform specific UI gestures - such as drag-and-drop or deliberate click sequences - to trigger incorrect rendering of the browser's file selection security UI. No public exploit identified at time of analysis; EPSS at 0.03% (11th percentile) signals very low exploitation probability, consistent with no CISA KEV listing.

Technical ContextAI

The vulnerability resides in the File Input component (<input type='file'>) of Google Chrome's rendering engine, affecting all desktop platform builds prior to version 149.0.7827.53. CWE-451 (User Interface Misrepresentation of Critical Information) is the root cause class: the browser fails to correctly render or enforce visual security indicators associated with file selection dialogs, allowing a malicious HTML page to present a deceptive UI. This class of bug typically arises when UI state is not correctly synchronized with underlying security boundaries, enabling an attacker-controlled page to influence what the user perceives as a trustworthy browser-native interface. The affected versions are confirmed via ENISA EUVD-2026-34677 and the Chromium issue tracker (issues.chromium.org/issues/474583539).

RemediationAI

The primary fix is upgrading Google Chrome to version 149.0.7827.53 or later, as documented in the stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome auto-updates by default on consumer installations; enterprise administrators should verify deployment via Google Chrome Enterprise policy or patch management tooling and push the update proactively. No workarounds or compensating controls are documented for this vulnerability. Given the requirement for user interaction and the low CVSS impact score, the primary mitigation outside patching is user awareness: instruct users not to interact with unexpected file dialog prompts on unfamiliar websites, particularly those requesting specific drag-and-drop or gesture-based interaction. This is a low-friction advisory update with no known side effects.