What is the CVSS score of CVE-2026-11247?

CVE-2026-11247 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11247?

Yes, a patch is available for CVE-2026-11247. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11247

EUVD-2026-34708 LOW

Protection Mechanism Failure (CWE-693)

2026-06-05 chrome-cve-admin@google.com

GHSA-rrv6-h93v-3p5p

Information Disclosure Google

3.1

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Primary rating from Vendor (google) · only source for this CVE.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 14:26 vuln.today

CVSS changed

Jun 05, 2026 - 14:22 NVD

3.1 (LOW)

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in CustomTabs in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Cross-origin data leakage in Google Chrome's CustomTabs component on Android exposes sensitive information to remote attackers via a crafted HTML page. Affected versions are all Chrome for Android releases prior to 149.0.7827.53, where insufficient policy enforcement in the CustomTabs API fails to uphold cross-origin isolation guarantees. No public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV not listed); the EPSS score of 0.03% (11th percentile) and a CVSS score of 3.1 (Low) together indicate low real-world exploitation likelihood.

Technical ContextAI

CustomTabs is a Chrome-for-Android API that allows host applications to embed a Chrome browser session within their own UI, sharing the Chrome process, cookies, and security state. The root cause is classified as CWE-693 (Protection Mechanism Failure), meaning the Same-Origin Policy or an equivalent cross-origin data isolation mechanism is not correctly applied within the CustomTabs context. This can allow a page opened in CustomTabs to access or infer data belonging to a different origin - a boundary that must be enforced at the browser layer regardless of which host app invokes the tab. The affected CPE scope is Chrome on Android, confirmed by the EUVD entry (EUVD-2026-34708) which lists the affected range as Chrome versions below 149.0.7827.53.

RemediationAI

The primary fix is to update Google Chrome for Android to version 149.0.7827.53 or later, as confirmed by the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Android users should ensure automatic app updates are enabled via the Google Play Store. For organizations that deploy managed Chrome profiles on Android via Mobile Device Management (MDM), push the mandatory minimum version policy to enforce 149.0.7827.53 or above. No official workaround has been published for environments where the update cannot be immediately applied; as a compensating control, administrators could restrict the use of applications that invoke Chrome CustomTabs to render cross-origin or sensitive content until the update is deployed, though this may impact app functionality. No side effects of the patch have been noted by the vendor.