What is the CVSS score of CVE-2026-11253?

CVE-2026-11253 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11253?

Yes, a patch is available for CVE-2026-11253. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11253

EUVD-2026-34714 MEDIUM

Race Condition (CWE-362)

2026-06-05 chrome-cve-admin@google.com

GHSA-p7fv-8wx7-q5p2

Information Disclosure Google Race Condition

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

7.4 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 12:30 vuln.today

CVSS changed

Jun 05, 2026 - 12:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 05, 2026 - 00:17 nvd

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in Permissions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Cross-origin data leakage in Google Chrome's Permissions subsystem (prior to 149.0.7827.53) enables remote unauthenticated attackers to read data across origin boundaries via a crafted HTML page. The flaw, classified as a race condition (CWE-362) in the Permissions implementation, undermines the browser's Same-Origin Policy enforcement - a foundational web isolation mechanism. No public exploit identified at time of analysis; a vendor-released patch is available in version 149.0.7827.53, and Google has rated this Low severity in Chromium security terms.

Technical ContextAI

The vulnerability resides in the Permissions subsystem of the Chromium browser engine, which governs cross-origin access controls and resource isolation between web origins. CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) identifies the root cause as a race condition - a timing flaw in how permission checks are evaluated, creating a window during which cross-origin data may become accessible before or after a permission boundary is correctly enforced. This class of bug in browser permission logic directly threatens the Same-Origin Policy (SOP), the foundational mechanism preventing one origin from reading another's resources. Affected products per EUVD-2026-34714 are Google Chrome desktop versions in the range below 149.0.7827.53. The Chromium issue tracker entry at https://issues.chromium.org/issues/498397912 is the primary upstream record but may not be publicly disclosed.

RemediationAI

Upgrade Google Chrome to version 149.0.7827.53 or later - this is the vendor-released patch confirmed by the stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Enterprise administrators should push this update via Group Policy (Windows), managed preferences (macOS), or centralized browser management platforms such as Google Admin for Chrome Browser Cloud Management. Because exploitation requires user interaction with a crafted HTML page, deploying web content filtering to block untrusted or unknown external sites can reduce exposure as a compensating control pending upgrade - note this limits browsing functionality and does not address the underlying flaw. Ensuring Chrome's automatic update mechanism is enabled across the fleet minimizes the exposure window for this and similar browser-engine vulnerabilities. No workaround that disables the affected Permissions subsystem feature is documented in available references.