What is the CVSS score of CVE-2026-11246?

CVE-2026-11246 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11246?

Yes, a patch is available for CVE-2026-11246. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11246

EUVD-2026-34707 MEDIUM

Improper Input Validation (CWE-20)

2026-06-05 chrome-cve-admin@google.com

GHSA-q633-h8hg-5mvc

Authentication Bypass Google Red Hat Suse Chrome

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.8 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 13:29 vuln.today

CVSS changed

Jun 05, 2026 - 13:22 NVD

5.3 (MEDIUM)

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 05, 2026 - 00:17 nvd

MEDIUM 5.3

DescriptionCVE.org

Insufficient validation of untrusted input in IndexedDB in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Same-origin policy bypass in Google Chrome's IndexedDB implementation affects all versions prior to 149.0.7827.53, enabling an attacker who has already compromised the renderer process to cross origin boundaries via a crafted HTML page. The integrity-only impact (C:N/I:H/A:N) means a successful exploitation could allow unauthorized writes or data manipulation across origins, but does not directly expose confidential data. No public exploit code has been identified at time of analysis, and Google's own Chromium security team rated this Low severity; a vendor-released patch is available at version 149.0.7827.53.

Technical ContextAI

IndexedDB is a browser-native NoSQL key-value storage API exposed to web content through the renderer process. Insufficient validation of untrusted input (CWE-20) in Chrome's IndexedDB handling means that data or requests originating from a compromised renderer are not properly sanitized before being acted upon at a higher privilege boundary. The same-origin policy (SOP) is a foundational browser security control preventing cross-origin data access; a bypass here undermines a core web isolation guarantee. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U) indicates the attack originates over the network, requires high complexity (notably a pre-compromised renderer), does not require prior authentication, but does require user interaction. The affected CPE scope is Google Chrome releases prior to 149.0.7827.53, as confirmed by EUVD-2026-34707 and the Chrome stable channel advisory.

RemediationAI

Update Google Chrome to version 149.0.7827.53 or later via the browser's built-in update mechanism or through enterprise management tooling; this is the vendor-released patch confirmed by the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Because exploitation requires a pre-compromised renderer process, organizations that enforce Chrome's Site Isolation feature (--site-per-process, enabled by default in modern Chrome) and keep renderer sandbox hardening enabled already have a significant compensating control in place, as renderer compromise itself becomes harder. There is no documented workaround that mitigates the IndexedDB validation gap without patching. Disabling JavaScript or blocking IndexedDB API access via enterprise policy would prevent exploitation but would break a broad class of web applications and is not recommended as a standing control. Prioritize patching over workarounds given patch availability.