What is the CVSS score of CVE-2026-11221?

CVE-2026-11221 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11221?

Yes, a patch is available for CVE-2026-11221. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11221

EUVD-2026-34682 MEDIUM

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-9qmv-4v56-m279

Information Disclosure Google Red Hat Suse Chrome

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

3.5 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 15:29 vuln.today

CVSS changed

Jun 05, 2026 - 15:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 4.3

DescriptionCVE.org

Insufficient validation of untrusted input in PointerLock in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome's PointerLock API prior to version 149.0.7827.53 allows an attacker who has already compromised the renderer process to manipulate browser UI presentation via a crafted HTML page. The CVSS score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) reflects limited integrity-only impact with no confidentiality or availability consequences, and Google itself rated this 'Low' severity. No public exploit has been identified and the EPSS score of 0.05% (15th percentile) confirms very low real-world exploitation probability at time of analysis.

Technical ContextAI

The PointerLock API is a browser feature that locks the mouse cursor to a page element, primarily used in immersive applications such as browser-based games. CWE-20 (Improper Input Validation) indicates that Chrome's PointerLock subsystem fails to adequately validate untrusted input originating from the renderer process, allowing maliciously crafted inputs to produce spoofed or misleading UI states. The renderer process in Chrome operates within a sandboxed environment; exploitation therefore depends on the renderer being previously compromised via a separate vulnerability. The vulnerability affects all Chrome desktop versions prior to 149.0.7827.53 and is tracked by ENISA as EUVD-2026-34682. No CPE strings were provided in the available input data; affected scope is inferred from EUVD version range data.

RemediationAI

Update Google Chrome to version 149.0.7827.53 or later, the vendor-confirmed patched release documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism will handle this in most consumer environments; enterprise administrators should verify deployment via their endpoint management tooling (e.g., Google Admin Console, Intune, or equivalent). Given the low severity rating, renderer-compromise prerequisite, and absence of active exploitation, this patch is suitable for inclusion in standard monthly patch cycles rather than emergency out-of-band deployment. No documented workarounds are available in the referenced advisories. As a defense-in-depth measure, organizations may consider enforcing Chrome's Site Isolation policy (already default in modern Chrome) to limit renderer compromise blast radius, though this does not remediate this specific vulnerability.