What is the CVSS score of CVE-2026-11245?

CVE-2026-11245 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11245?

Yes, a patch is available for CVE-2026-11245. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11245

EUVD-2026-34706 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-05 chrome-cve-admin@google.com

GHSA-grqw-jmx4-rp5q

Information Disclosure Google Red Hat Suse Chrome

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 13:28 vuln.today

CVSS changed

Jun 05, 2026 - 13:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 05, 2026 - 00:17 nvd

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in Payments in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome's Payments component prior to version 149.0.7827.53 enables a remote unauthenticated attacker to mislead users about payment interface elements via a crafted HTML page. The vulnerability stems from inappropriate implementation logic (CWE-451) that allows visual misrepresentation of critical payment-related UI, potentially facilitating phishing or payment fraud against end users who interact with a malicious page. No public exploit code has been identified at time of analysis, and Chromium's internal severity rating is Low, consistent with its limited integrity-only, user-interaction-dependent impact.

Technical ContextAI

The flaw resides in the Payments subsystem of the Chromium rendering engine - the component responsible for rendering browser-native payment request dialogs and autofill UI. CWE-451 (UI Misrepresentation of Critical Information) describes scenarios where the browser fails to correctly display or isolate security-critical UI elements, allowing attacker-controlled web content to spoof or obscure them. The attack is delivered via a crafted HTML page, suggesting the payment UI surface (e.g., the Payment Request API dialog or credit card autofill overlay) can be manipulated in appearance or context by page-level content. Affected CPE corresponds to Google Chrome versions below 149.0.7827.53 on all supported desktop platforms per EUVD-2026-34706.

RemediationAI

The primary remediation is to update Google Chrome to version 149.0.7827.53 or later, available via Chrome's built-in updater (Settings > Help > About Google Chrome) or directly from the vendor stable channel release at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Enterprise administrators should push this update via Google Chrome Enterprise policy or their endpoint management platform without delay, prioritizing systems used for financial transactions. If immediate patching is not possible, a compensating control is to disable or restrict use of the Payment Request API via enterprise policy (PaymentMethodQueryEnabled=false), though this will break legitimate web payment flows on affected sites. Educating users to avoid entering payment information on unfamiliar sites provides partial social-engineering mitigation but does not address the underlying spoofing mechanism.