What is the CVSS score of CVE-2026-11252?

CVE-2026-11252 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11252?

Yes, a patch is available for CVE-2026-11252. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11252

EUVD-2026-34713 MEDIUM

Improper Access Control (CWE-284)

2026-06-05 chrome-cve-admin@google.com

GHSA-5mqf-cxmj-6pgf

Authentication Bypass Google Red Hat Suse Chrome

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

5.4 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 12:30 vuln.today

CVSS changed

Jun 05, 2026 - 12:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 05, 2026 - 00:17 nvd

MEDIUM 4.3

DescriptionCVE.org

Insufficient policy enforcement in Content Settings in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Content Settings policy enforcement bypass in Google Chrome prior to 149.0.7827.53 enables remote attackers to circumvent discretionary access control by delivering a crafted HTML page to a victim who must interact with it. Rooted in CWE-284 (Improper Access Control), the flaw affects Chrome's Content Settings subsystem - which governs site-level permissions such as cookies, notifications, and script access - yielding a limited integrity impact with no confidentiality or availability consequences. No public exploit has been identified and the vulnerability is absent from CISA KEV; the vendor itself rates this as Low severity, consistent with the CVSS 4.3 base score.

Technical ContextAI

Google Chrome's Content Settings subsystem enforces per-origin access control policies governing browser-level permissions including JavaScript execution, cookies, camera, microphone, and notifications. CWE-284 (Improper Access Control) identifies the root cause as a failure to correctly enforce these policies at the content-settings layer when parsing or rendering a specially constructed HTML document. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms this is network-reachable with low attack complexity and no required privileges, but requires user interaction - indicating the exploit payload is delivered via a web page the victim must visit. Scope:Unchanged means the flaw does not escape Chrome's process boundary into the underlying OS or other applications. The Chromium issue tracker entry (issues.chromium.org/issues/498373018) is the upstream technical reference for the fix.

RemediationAI

The primary remediation is to upgrade Google Chrome to version 149.0.7827.53 or later, which is confirmed available per the vendor's stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Enterprise environments managing Chrome via group policy or device management platforms (Google Admin Console, Intune) should deploy this update through their standard software distribution pipeline. As a temporary compensating control for environments unable to patch immediately, administrators can enforce maximally restrictive Content Settings via Chrome enterprise policy templates to reduce the permission surface exploitable through this flaw; note this may disrupt legitimate site functionality relying on browser-managed permissions. No additional vendor-documented workarounds are available beyond applying the update.