What is the CVSS score of CVE-2026-11251?

CVE-2026-11251 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11251?

Yes, a patch is available for CVE-2026-11251. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11251

EUVD-2026-34712 LOW

Improper Input Validation (CWE-20)

2026-06-05 chrome-cve-admin@google.com

GHSA-x55h-6hhf-jw8h

Authentication Bypass Google Chrome

3.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 12:29 vuln.today

CVSS changed

Jun 05, 2026 - 12:22 NVD

3.1 (LOW)

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Insufficient policy enforcement in Google Chrome's Password Manager (versions prior to 149.0.7827.53) allows a remote attacker who has already compromised the renderer process to bypass discretionary access control via a crafted HTML page, resulting in limited confidentiality exposure. This is a chained vulnerability: exploitation is contingent on a prior renderer process compromise, which substantially elevates attack complexity and limits realistic blast radius. No public exploit code exists and this CVE is not listed in the CISA KEV catalog. Google has rated this Low severity and released a fix in Chrome 149.0.7827.53.

Technical ContextAI

The vulnerability resides in the Password Manager component of Google Chromium, the open-source browser engine underpinning Google Chrome. CWE-20 (Improper Input Validation) indicates that the Password Manager's policy enforcement logic fails to adequately validate state or inputs when the renderer process - the sandboxed content process responsible for parsing and rendering HTML - has been compromised. Chrome's security model relies on process isolation and a multi-layer permission/policy framework; a compromised renderer should be constrained from accessing sensitive browser state like stored credentials. This flaw breaks that isolation boundary specifically within the Password Manager subsystem. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) confirms the attack is network-delivered, requires high complexity, no attacker privileges, user interaction, and produces only limited confidentiality impact with no scope change, meaning the attacker cannot pivot further beyond the user's browser session context.

RemediationAI

Upgrade Google Chrome to version 149.0.7827.53 or later, which contains the vendor-released fix as confirmed by the Chrome Stable Channel Update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome typically auto-updates on desktop platforms; administrators managing enterprise fleets should verify deployment via Chrome Browser Cloud Management or Group Policy. Because exploitation requires a prior renderer process compromise, organizations can reduce the overall attack surface by ensuring Chrome's sandbox is not disabled (avoid --no-sandbox flags in managed deployments), keeping all Chromium-based browser components up to date to reduce the likelihood of a renderer exploit chain being viable, and enforcing Chrome enterprise policies to restrict access to Password Manager features on high-sensitivity endpoints if credential exposure is a concern. No additional workarounds are required for most deployments given the low severity and chained exploitation requirement.