What is the CVSS score of CVE-2026-11254?

CVE-2026-11254 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11254?

Yes, a patch is available for CVE-2026-11254. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11254

EUVD-2026-34715 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-05 chrome-cve-admin@google.com

GHSA-q9xv-w349-hffr

Information Disclosure Google Red Hat Suse Chrome

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 12:31 vuln.today

CVSS changed

Jun 05, 2026 - 12:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 05, 2026 - 00:17 nvd

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in Permissions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome's Permissions implementation prior to version 149.0.7827.53 allows a remote, unauthenticated attacker to deceive users through manipulated browser permission dialogs via a crafted HTML page. Exploitation requires user interaction - a victim must visit a malicious page - and the real-world impact is limited to low-integrity outcomes such as misleading users into granting or denying permissions under false pretenses. No public exploit code exists and this vulnerability has not been added to the CISA KEV catalog at time of analysis.

Technical ContextAI

CWE-451 (User Interface Misrepresentation of Critical Information) describes flaws where the UI presents misleading or inaccurate information to the user, undermining trust decisions. In Chrome's Permissions subsystem, this implementation flaw allows a crafted HTML page to manipulate how permission prompts - such as those for geolocation, camera, microphone, or notifications - are rendered or contextualized, enabling an attacker to spoof the origin, context, or nature of a permission request. The affected codebase corresponds to Chromium's permissions UI layer, tracked in Chromium issue 498405554. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms the flaw is remotely triggerable with no authentication and low complexity, but requires user interaction to reach the vulnerable code path.

RemediationAI

Update Google Chrome to version 149.0.7827.53 or later, which contains the vendor-released patch for this issue. The stable channel update is documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome's automatic update mechanism should apply this patch without manual intervention for most users; administrators managing enterprise deployments should verify fleet-wide rollout via Google Admin Console or equivalent endpoint management tooling. No workarounds are identified for this issue given its location in the browser's core permissions UI; the only reliable mitigation is applying the patch. Given the low severity, emergency out-of-band deployment is not warranted, but inclusion in the next standard patch cycle is recommended.