What is the CVSS score of CVE-2026-11255?

CVE-2026-11255 has a contested CVSS base score of 7.5 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11255?

Google Chrome desktop versions prior to 149.0.7827.53 contain a cross-origin data leakage vulnerability that can expose sensitive user information if the renderer process is compromised.. A patch is available.

How to fix or mitigate CVE-2026-11255?

Within 24 hours: Identify and catalog all Chrome desktop systems and their current versions. Within 7 days: Deploy Chrome version 149.0.7827.53 or later organization-wide via your standard patch management system. Within 30 days: Verify complete deployment coverage and establish monitoring for indicators of renderer process compromise.

Google Chrome CVE-2026-11255

EUVD-2026-34716 HIGH

Improper Input Validation (CWE-20)

2026-06-05 chrome-cve-admin@google.com

GHSA-fxqm-4w5x-3wrq

Information Disclosure Google

High

Disputed · 7.5 Vendor: google

Severity by source

Sources disagree (Low–High)

Vendor (google) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SUSE

HIGH

qualitative

Red Hat

6.8 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 12:25 vuln.today

CVSS changed

Jun 05, 2026 - 12:22 NVD

7.5 (HIGH)

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 05, 2026 - 00:17 nvd

HIGH 7.5

DescriptionCVE.org

Insufficient validation of untrusted input in Storage Access API in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Cross-origin data leakage in Google Chrome's Storage Access API affects desktop versions prior to 149.0.7827.53, enabling a remote attacker who has already compromised the renderer process to exfiltrate sensitive cross-origin information via a specially crafted HTML page. Google rates the underlying Chromium severity as Low, though NVD assigns CVSS 7.5 due to the unauthenticated network vector, and no public exploit identified at time of analysis.

Technical ContextAI

The vulnerability resides in Chrome's implementation of the Storage Access API, a web platform feature that lets embedded third-party content request access to first-party cookies and storage in cross-site contexts (e.g., iframes). The root cause is CWE-20 (Improper Input Validation): the API fails to sufficiently validate untrusted inputs received from a renderer, which normally relies on the browser process to enforce the same-origin policy and storage partitioning. A compromised renderer - typically the outcome of a prior memory-safety or logic bug - can therefore manipulate Storage Access API interactions to read data that should be isolated under Chrome's site-isolation and storage-partitioning model. The Chromium component is shipped across all desktop Chrome channels (Windows, macOS, Linux) and downstream Chromium-based browsers that consume the same code.

RemediationAI

Upgrade Google Chrome on all desktop platforms to 149.0.7827.53 or later - vendor-released patch is available per the Chrome stable-channel announcement at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. In managed environments, validate that Chrome auto-update is functioning and force a relaunch via enterprise policy (RelaunchNotification / RelaunchNotificationPeriod) to ensure users actually load the patched binary. No vendor-documented workaround exists; as a temporary compensating control, organizations could disable the Storage Access API via the chrome://flags/#storage-access-api flag or enterprise policy where supported, but this will break legitimate cross-site embed scenarios (federated login widgets, embedded media that rely on first-party storage). Operators of Chromium-based browsers should monitor their vendor channels and apply the corresponding update once the merge from upstream Chromium issue 498417152 lands.