What is the CVSS score of CVE-2026-11222?

CVE-2026-11222 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11222?

Yes, a patch is available for CVE-2026-11222. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11222

EUVD-2026-34683 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-04 chrome-cve-admin@google.com

GHSA-64fj-m7v5-688g

Information Disclosure Google

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 15:29 vuln.today

CVSS changed

Jun 05, 2026 - 15:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

DescriptionCVE.org

Incorrect security UI in Tab Strip in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Domain spoofing via Tab Strip UI misrepresentation in Google Chrome prior to 149.0.7827.53 enables remote unauthenticated attackers to deceive users into believing they are visiting a legitimate domain by serving a crafted HTML page that corrupts the displayed origin in the tab strip. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms network-accessible exploitation requiring no privileges but requiring user interaction, with integrity impact reflecting successful identity deception rather than data exfiltration or code execution. No public exploit code exists and EPSS at 0.03% (11th percentile) reflects negligible observed exploitation activity; this is not currently listed in the CISA KEV catalog.

Technical ContextAI

The vulnerability resides in Chrome's Tab Strip component, which is responsible for rendering tab UI elements including the visual representation of the active page's origin. CWE-451 (User Interface Misrepresentation of Critical Information) describes the root cause: a failure to correctly update or constrain the security-relevant UI element (the displayed domain/tab label) in response to navigation or page manipulation via a crafted HTML page. This is not a memory safety issue; it is a logic flaw in how the Tab Strip reflects the true security origin of loaded content, a class of vulnerability that undermines the browser's origin-isolation guarantees at the visual layer. Affected product per EUVD: Google Chrome desktop versions in the range below 149.0.7827.53.

RemediationAI

Update Google Chrome to version 149.0.7827.53 or later, which contains the vendor-released patch for this vulnerability. The stable channel release advisory is available at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Enterprise administrators should prioritize deployment via managed update policies (Google Admin Console or Chrome Browser Cloud Management). No documented workaround exists for the Tab Strip UI misrepresentation flaw short of upgrading; disabling JavaScript does not mitigate this class of UI spoofing issue. Organizations relying on browser-based security indicators as part of user training should treat this as a prompt to reinforce that the address bar (omnibox) rather than the tab strip label is the authoritative trust indicator.