What is the CVSS score of CVE-2026-11248?

CVE-2026-11248 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11248?

Google Chrome versions prior to 149.0.7827.53 contain a navigation restriction bypass vulnerability enabling attackers to redirect users to unauthorized websites through malicious web pages, exposing…. A patch is available.

How to fix or mitigate CVE-2026-11248?

24 hours: Inventory Chrome deployments in enterprise and BYOD environments; issue security advisory to users. 7 days: Deploy Chrome 149.0.7827.53 via standard patch management to all managed endpoints; enable automatic updates. 30 days: Verify patch deployment completion across 95%+ of endpoints; monitor EDR/proxy logs for exploitation activity.

Google Chrome CVE-2026-11248

EUVD-2026-34709 HIGH

Protection Mechanism Failure (CWE-693)

2026-06-05 chrome-cve-admin@google.com

GHSA-ppwm-hj26-hxcv

Authentication Bypass Google Red Hat Suse Chrome

High

Disputed · 8.8 NVD

Severity by source

Sources disagree (Low–High)

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

5.4 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 13:24 vuln.today

CVSS changed

Jun 05, 2026 - 13:22 NVD

8.8 (HIGH)

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 05, 2026 - 00:17 nvd

HIGH 8.8

DescriptionCVE.org

Inappropriate implementation in Google Lens in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Navigation restriction bypass in Google Chrome's Lens component prior to version 149.0.7827.53 allows a remote attacker to circumvent browser security boundaries via a crafted HTML page. The flaw requires user interaction (UI:R) to trigger, but no authentication, and Google classifies the Chromium security severity as Low despite the NVD CVSS of 8.8. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

The vulnerability resides in Google Lens, the visual search and image-recognition feature integrated into Chrome's desktop builds. It is classified as CWE-693 (Protection Mechanism Failure), meaning a security control - specifically Chrome's navigation restrictions that govern where and how the browser may follow links or initiate cross-origin transitions - is incorrectly implemented within the Lens code path. By feeding Lens a crafted HTML page, an attacker can route navigation through that weakened check, evading the same-origin or URL-handling guardrails the engine normally enforces. The vendor labels this an 'Inappropriate implementation' bug, a Chromium category typically used for logic errors in security boundaries rather than memory-corruption flaws.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - update Chrome via the built-in updater or redeploy the Stable Channel build referenced at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Enterprise administrators using Chrome Browser Cloud Management or group policy should push the 149.0.7827.53 (or later) MSI/PKG to managed endpoints and confirm restart-to-update compliance. As a compensating control until rollout completes, the Lens feature can be restricted via the LensRegionSearchEnabled and LensDesktopNTPSearchEnabled enterprise policies (set to false), which disables Lens entry points and removes the vulnerable code path's reachability, at the cost of losing the visual-search UX for users. Blocking navigation to attacker-controlled HTML at the network egress (web filtering, safe-browsing enforcement) reduces exposure but does not address the root cause. Further details may appear on the restricted Chromium issue tracker entry at https://issues.chromium.org/issues/497946941 once access is opened.