What is the CVSS score of CVE-2026-11226?

CVE-2026-11226 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11226?

Yes, a patch is available for CVE-2026-11226. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11226

EUVD-2026-34687 MEDIUM

Origin Validation Error (CWE-346)

2026-06-04 chrome-cve-admin@google.com

GHSA-qf3m-3w2w-q7r8

Authentication Bypass Google

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 15:35 vuln.today

CVSS changed

Jun 05, 2026 - 15:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in PreviewTab in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Same-origin policy bypass in the PreviewTab component of Google Chrome for Android (versions prior to 149.0.7827.53) enables a remote unauthenticated attacker to violate cross-origin isolation and corrupt content integrity. Exploitation requires social engineering - the victim must visit a crafted HTML page and be manipulated into performing specific UI gestures within the PreviewTab interface. The CVSS vector scores high integrity impact (I:H) with no confidentiality or availability impact, indicating an attacker can alter or inject content across origin boundaries but cannot directly exfiltrate data. No public exploit code or CISA KEV listing has been identified; EPSS sits at 0.02% (4th percentile), reflecting very low current exploitation probability.

Technical ContextAI

The affected component is PreviewTab, a Chrome for Android UI feature that allows users to preview linked pages before fully navigating. The root cause is classified under CWE-346 (Origin Validation Error), meaning the browser fails to properly enforce same-origin policy (SOP) checks within this feature's policy enforcement layer. SOP is the foundational browser security boundary that prevents scripts on one origin from accessing or modifying resources belonging to a different origin. When PreviewTab insufficiently validates origin context - for instance, failing to isolate the preview's browsing context from the initiating page's origin - a crafted HTML page can exploit the gap to influence cross-origin content. This class of bug is Android-specific, tied to the mobile Chrome UI surface rather than the shared Chromium rendering engine core. The fix is confirmed available in Chrome 149.0.7827.53 for Android per the vendor's stable channel release advisory.

RemediationAI

The primary fix is to update Google Chrome for Android to version 149.0.7827.53 or later, which is confirmed available via the vendor's stable channel release. Users should apply this update through the Google Play Store. The vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html provides confirmation of the fix. No patch is required for desktop Chrome platforms as this vulnerability is Android-specific. If immediate patching is not feasible, a practical compensating control is to disable or avoid using the PreviewTab feature through Chrome flags (chrome://flags), which removes the vulnerable UI surface entirely; this may degrade link preview functionality but eliminates the attack vector. Restricting access to untrusted or unknown URLs through enterprise mobile device management (MDM) policy can also reduce exposure for managed Android fleets.