What is the CVSS score of CVE-2026-11217?

CVE-2026-11217 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11217?

Yes, a patch is available for CVE-2026-11217. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11217

EUVD-2026-34678 MEDIUM

Origin Validation Error (CWE-346)

2026-06-04 chrome-cve-admin@google.com

GHSA-w88q-hw69-7rhh

Authentication Bypass Google

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

SUSE

MEDIUM

qualitative

Red Hat

5.9 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 15:27 vuln.today

CVSS changed

Jun 05, 2026 - 15:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

DescriptionCVE.org

Inappropriate implementation in Fenced Frames in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Site isolation bypass in Google Chrome's Fenced Frames component allows an attacker who has already compromised the renderer process to cross origin boundaries via a crafted HTML page. Affected versions are all Chrome releases prior to 149.0.7827.53 on desktop platforms. No public exploit code has been identified at time of analysis, and EPSS sits at a low 0.02% (4th percentile), consistent with Chromium's own 'Low' severity rating despite the 6.5 CVSS score - real-world risk is contingent on a separate, preceding renderer exploit.

Technical ContextAI

Fenced Frames is a Privacy Sandbox HTML primitive introduced in Chrome that embeds cross-site content without allowing bidirectional communication between the embedder and the framed content, serving as a site isolation enforcement boundary. CWE-346 (Origin Validation Error) identifies the root cause: the Fenced Frames implementation does not correctly validate origin or isolation context, allowing a malicious renderer to subvert the cross-site boundary guarantees the feature is designed to enforce. The affected component is the Blink rendering engine's Fenced Frames implementation (tracked in Chromium issue 487564032). CPE-implied scope covers Google Chrome for desktop (Windows, macOS, Linux) on all channels prior to stable version 149.0.7827.53.

RemediationAI

Update Google Chrome to version 149.0.7827.53 or later; this is the vendor-confirmed patched release documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism will deliver this for most users, but enterprise environments managing Chrome via policy should verify deployment via chrome://settings/help or fleet management tooling. Because exploitation requires prior renderer compromise, organizations that enforce Chrome's Site Isolation policy (--site-per-process, enabled by default since Chrome 67) and keep renderer sandboxing enabled gain defense-in-depth even before patching. Disabling Fenced Frames via enterprise policy is a potential workaround but may break Privacy Sandbox features and is not formally recommended by Google as a mitigation for this issue.