What is the CVSS score of CVE-2026-11227?

CVE-2026-11227 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11227?

Yes, a patch is available for CVE-2026-11227. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11227

EUVD-2026-34688 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-04 chrome-cve-admin@google.com

GHSA-2jrr-2q54-q6ww

Information Disclosure Google Red Hat Suse Chrome

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

SUSE

MEDIUM

qualitative

Red Hat

0.0 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 15:36 vuln.today

CVSS changed

Jun 05, 2026 - 15:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Incorrect security UI in Tab Hover Cards in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofing via a crafted domain name. (Chromium security severity: Low)

AnalysisAI

Tab Hover Cards in Google Chrome prior to 149.0.7827.53 render domain names incorrectly, enabling a remote unauthenticated attacker to spoof displayed domain identity via a crafted domain name, misleading users about the true destination of a browser tab. CVSS rates Integrity impact as High (I:H), reflecting the real deception potential in phishing scenarios, while Chromium itself labels this Low severity - a notable contrast worth flagging. No public exploit identified at time of analysis, and EPSS at 0.03% (11th percentile) reflects minimal current exploitation interest.

Technical ContextAI

CWE-451 (User Interface Misrepresentation of Critical Information) describes flaws where security-critical UI elements display misleading or incorrect information, undermining user trust decisions. Tab Hover Cards are tooltip-style overlays shown in Chrome when a user hovers over a browser tab, intended to convey the page title and URL of the underlying tab. The root cause here is incorrect rendering logic within that hover card component - likely failing to normalize or validate internationalized domain names (IDN), Unicode homograph characters, or other crafted domain string formats before display, causing the card to present a spoofed domain rather than the true resolved destination. The address bar rendering pipeline (a separate code path) is not implicated. Chromium issue 448421954 is referenced but access may be restricted pending stable release.

RemediationAI

Update Google Chrome to version 149.0.7827.53 or later, as confirmed by the vendor's stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome typically self-updates, but users should verify their version via chrome://settings/help and force an update if needed. Enterprise administrators using Chrome Browser Cloud Management or Group Policy should enforce a minimum version floor of 149.0.7827.53. As a compensating control where immediate patching is not feasible, organizations should instruct users never to rely on Tab Hover Cards as a URL verification mechanism and instead confirm destinations via the address bar - noting this is a behavioral mitigation with no enforcement mechanism. Disabling Tab Hover Cards via chrome://flags/#tab-hover-cards eliminates the vulnerable UI surface but removes tab preview functionality entirely, which may impact usability for power users managing many tabs.