What is the CVSS score of CVE-2026-11243?

CVE-2026-11243 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11243?

Yes, a patch is available for CVE-2026-11243. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11243

EUVD-2026-34704 MEDIUM

Origin Validation Error (CWE-346)

2026-06-05 chrome-cve-admin@google.com

GHSA-j665-28q6-pwvc

Authentication Bypass Google Red Hat Suse Chrome

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 13:28 vuln.today

CVSS changed

Jun 05, 2026 - 13:22 NVD

5.4 (MEDIUM)

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 05, 2026 - 00:17 nvd

MEDIUM 5.4

DescriptionCVE.org

Inappropriate implementation in Downloads in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Navigation restriction bypass in Google Chrome's Downloads subsystem prior to version 149.0.7827.53 enables a remote unauthenticated attacker to circumvent browser navigation controls by luring a user to a crafted HTML page. The flaw is rooted in an inappropriate implementation classified as CWE-346 (Origin Validation Error), meaning Chrome fails to properly validate the origin of requests or data within the Downloads flow. Rated Medium by CVSS (5.4) and Low by Chromium's own severity scale, no public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

The vulnerability resides in Google Chrome's Downloads feature and is classified under CWE-346 (Origin Validation Error). This CWE describes failures where a component does not properly verify the source or origin of incoming data or requests before acting on them - in this context, the Downloads subsystem can be manipulated by a crafted HTML page to treat navigation requests as originating from a trusted context, bypassing restrictions that would normally gate where the browser is allowed to navigate. ENISA EUVD-2026-34704 confirms the affected product range as Chrome versions below 149.0.7827.53 across supported desktop platforms. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) indicates the flaw is network-reachable, requires no privileges on the attacker's side, but does require a user to interact with a malicious page.

RemediationAI

Update Google Chrome to version 149.0.7827.53 or later, which contains the vendor-released patch addressing this flaw. This is a confirmed vendor patch per Google's stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome typically auto-updates for consumer installations; enterprise administrators using managed deployments should verify version propagation through their device management policy and confirm browsers have received the update. As a compensating control for environments where immediate patching is not feasible, restricting user access to untrusted or unclassified external websites via proxy-based URL filtering would reduce exposure to crafted HTML pages, though this carries operational impact for general browsing workflows. Disabling or restricting download initiation from untrusted origins via Chrome enterprise policies is a targeted but potentially disruptive alternative mitigation.