What is the CVSS score of CVE-2026-11244?

CVE-2026-11244 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11244?

Yes, a patch is available for CVE-2026-11244. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11244

EUVD-2026-34705 LOW

Improper Input Validation (CWE-20)

2026-06-05 chrome-cve-admin@google.com

GHSA-q6p3-5hc9-mj6w

Authentication Bypass Google Chrome

3.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 13:28 vuln.today

CVSS changed

Jun 05, 2026 - 13:22 NVD

3.1 (LOW)

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in WebAuthentication in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Same-origin policy bypass in Google Chrome's WebAuthentication component affects all Chrome versions prior to 149.0.7827.53, exploitable only by a remote attacker who has already compromised the renderer process. Insufficient input validation in the WebAuthn subsystem allows crafted HTML pages to circumvent same-origin restrictions, resulting in limited confidentiality disclosure (C:L). Chromium's own severity classification is Low, consistent with the CVSS 3.1 score of 3.1, and no public exploit or CISA KEV listing has been identified at time of analysis. The mandatory prerequisite of renderer process compromise significantly constrains the realistic attacker population to sophisticated, multi-stage threat actors.

Technical ContextAI

The vulnerability resides in Chrome's WebAuthentication (WebAuthn) implementation, the browser subsystem handling FIDO2/passkey credential flows. CWE-20 (Improper Input Validation) identifies the root cause: attacker-controlled input from a crafted HTML page is not sufficiently sanitized or validated before being processed within the WebAuthn code path. Because Chrome's multi-process architecture isolates renderer processes from the browser process, the attacker must first breach that sandbox - a non-trivial precondition. The CVSS vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N reflects a network-reachable flaw requiring high attack complexity (the renderer compromise) and user interaction (visiting a crafted page), with impact limited to low confidentiality loss and no scope change. Affected CPE is all Chrome desktop releases prior to 149.0.7827.53 per EUVD entry EUVD-2026-34705.

RemediationAI

Update Google Chrome to version 149.0.7827.53 or later, which contains the vendor-released patch per the stable channel update advisory at chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism will deliver this fix automatically in most managed and consumer environments; administrators should verify deployment via enterprise policy or endpoint telemetry. Because exploitation requires prior renderer compromise, organizations that have not already done so should enable Chrome's Site Isolation feature (--site-per-process, enabled by default in recent Chrome versions) and enforce renderer sandbox policies, as these controls independently reduce the likelihood that a renderer compromise can be achieved as the prerequisite step. No workaround that eliminates this specific same-origin bypass without upgrading has been identified in the available intelligence.