What is the CVSS score of CVE-2026-11242?

CVE-2026-11242 has a contested CVSS base score of 7.5 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11242?

Google Chrome versions prior to 149.0.7827.53 contain a cross-origin data disclosure vulnerability that allows attackers with browser-level access to leak sensitive data across security boundaries.. A patch is available.

How to fix or mitigate CVE-2026-11242?

Within 24 hours: Identify all Chrome deployments and current version distribution across your environment. Within 7 days: Deploy Chrome 149.0.7827.53 or later to all systems using automated update mechanisms; verify renderer isolation features remain enabled. Within 30 days: Complete patch deployment across all endpoints and validate origin isolation functionality through spot-checking.

Google Chrome CVE-2026-11242

EUVD-2026-34703 HIGH

Improper Input Validation (CWE-20)

2026-06-05 chrome-cve-admin@google.com

GHSA-4586-rwvx-3g6j

Information Disclosure Google Red Hat Suse Chrome

High

Disputed · 7.5 NVD

Severity by source

Sources disagree (Low–High)

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SUSE

HIGH

qualitative

Red Hat

7.4 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 13:24 vuln.today

CVSS changed

Jun 05, 2026 - 13:22 NVD

7.5 (HIGH)

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 05, 2026 - 00:17 nvd

HIGH 7.5

DescriptionCVE.org

Insufficient validation of untrusted input in Plugins in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Cross-origin data disclosure in Google Chrome versions prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to leak data across origin boundaries by serving a crafted HTML page through the Plugins component. No public exploit has been identified at time of analysis, and Chromium rates the underlying issue as Low severity despite the NVD CVSS of 7.5. The flaw stems from insufficient validation of untrusted input (CWE-20) within Chrome's plugin handling path.

Technical ContextAI

The defect lives in Chrome's Plugins subsystem, the component responsible for mediating between web content and embedded plugin instances within the multi-process sandbox model. CWE-20 (Improper Input Validation) here manifests as the browser-side code accepting attacker-influenced data from a compromised renderer without adequately enforcing the Same-Origin Policy, enabling cross-origin reads that the renderer alone should not be able to obtain. Because Chrome's security model treats the renderer as untrusted and enforces origin boundaries at higher-privileged layers, a validation gap in the plugin path effectively weakens one of the browser's core isolation guarantees. The affected build is identified by Chrome version string 149.0.7827.53, and the fix shipped through the Stable channel desktop update referenced in the Chrome Releases blog and Chromium issue tracker entry 497385823.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - update Chrome via the Stable channel auto-updater or by triggering chrome://settings/help, then restart the browser to apply, as documented in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. For managed fleets, push the updated MSI/PKG/DEB through enterprise deployment tooling and verify version pinning policies do not hold endpoints on a vulnerable build. No vendor-specified workaround exists; as a compensating control while patching is rolled out, organizations can restrict use of plugin-dependent content by tightening Chrome enterprise policies that constrain plugin invocation, accepting the trade-off that legitimate plugin-using workflows will break, and can block or sandbox high-risk browsing through network egress controls - though neither addresses the bug directly and both have meaningful user-experience cost. Downstream Chromium-based browser users should monitor their vendor's release notes for the corresponding rebase.