What is the CVSS score of CVE-2026-11223?

CVE-2026-11223 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11223?

Yes, a patch is available for CVE-2026-11223. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11223

EUVD-2026-34684 MEDIUM

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-jp3q-3vh2-xf59

Authentication Bypass Google

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.8 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 15:30 vuln.today

CVSS changed

Jun 05, 2026 - 15:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Same-origin policy bypass in Google Chrome's Network component (versions prior to 149.0.7827.53) enables a post-compromise attacker who already controls the renderer process to subvert cross-origin enforcement via a crafted HTML page. The CVSS integrity impact is rated High (I:H), but exploitation is gated behind a required renderer-process pre-compromise, substantially raising the real-world attack bar. No public exploit code exists and no CISA KEV listing is present; EPSS stands at 0.02% (6th percentile), consistent with Google's own Low severity rating for this issue.

Technical ContextAI

The vulnerability resides in Chrome's Network component - the subsystem responsible for HTTP/HTTPS request handling, cookie enforcement, and cross-origin policy decisions - and is classified under CWE-20 (Improper Input Validation). Chrome's multi-process sandbox architecture routes renderer-process network requests through IPC to the browser process, where same-origin policy is enforced. When the Network component fails to sufficiently validate untrusted input originating from the renderer, a compromised renderer can supply crafted inputs that cause SOP checks to be bypassed, enabling unauthorized cross-origin write operations. Affected product per ENISA EUVD-2026-34684 is Google Chrome versions in the range below 149.0.7827.53 on all supported desktop platforms.

RemediationAI

The primary remediation is to upgrade Google Chrome to version 149.0.7827.53 or later, as detailed in the stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome auto-updates in consumer environments; enterprise administrators using Google Update or Group Policy should verify deployment of this version promptly. As a compensating control for environments delaying the update, enforcing Chrome's Site Isolation mode (--site-per-process, the current default) limits the blast radius of any renderer-level compromise that could be used to trigger this secondary bypass. Restricting users from visiting untrusted or externally supplied URLs in browser sessions that handle sensitive cross-origin data also reduces the attack surface for the required upstream renderer exploit. Note that these controls address the prerequisite stage of the attack chain rather than the specific vulnerability itself.