What is the CVSS score of CVE-2026-11220?

CVE-2026-11220 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11220?

Yes, a patch is available for CVE-2026-11220. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11220

EUVD-2026-34681 MEDIUM

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-qxmv-95v4-9qpr

Authentication Bypass Google

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.8 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 15:28 vuln.today

CVSS changed

Jun 05, 2026 - 15:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

DescriptionCVE.org

Insufficient validation of untrusted input in Navigation in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Site isolation bypass in Google Chrome's Navigation component allows a remote attacker who has already compromised the renderer process to break Chrome's cross-origin security boundary via a crafted HTML page. Affected versions are all Chrome releases prior to 149.0.7827.53. The CVSS vector (I:H) reflects high integrity impact against protected origins, but the real-world risk is substantially gated by the prerequisite of renderer process compromise - a condition Google itself rates as 'Low' severity in Chromium's internal classification. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

The vulnerability resides in Chrome's Navigation component and is classified as CWE-20 (Improper Input Validation). Chrome's site isolation architecture places different web origins into separate renderer processes to enforce security boundaries; insufficient validation of untrusted input during navigation allows a compromised renderer to influence cross-site navigation logic in ways that violate this boundary. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) indicates network delivery with no privileges required and user interaction needed, with scope remaining unchanged - meaning the impact is confined to the current security context rather than escaping it. Affected product per EUVD: Google Chrome versions in the range prior to 149.0.7827.53.

RemediationAI

Upgrade Google Chrome to version 149.0.7827.53 or later; this is a vendor-released patch confirmed via the stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism should handle this for most users, but enterprise deployments using managed update policies should verify rollout completion. As a compensating control prior to patching, organizations can restrict user access to untrusted or external web content via URL filtering or managed browser profiles, which reduces the delivery surface for the crafted HTML page required to trigger the vulnerability. Note that this control limits user functionality and does not address the underlying flaw. Disabling JavaScript broadly would reduce exposure but would break the majority of enterprise web applications and is not a practical enterprise-wide control.