What is the CVSS score of CVE-2026-11257?

CVE-2026-11257 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11257?

Yes, a patch is available for CVE-2026-11257. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11257

EUVD-2026-34718 MEDIUM

Improper Access Control (CWE-284)

2026-06-05 chrome-cve-admin@google.com

GHSA-6ghh-h4xg-rhf2

Authentication Bypass Google

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

5.4 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 20:47 vuln.today

CVSS changed

Jun 05, 2026 - 20:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 05, 2026 - 00:17 nvd

MEDIUM 4.3

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Browser in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Navigation restriction bypass in Google Chrome prior to 149.0.7827.53 allows a remote unauthenticated attacker to circumvent browser-enforced navigation controls by delivering a crafted HTML page to a victim. The flaw is classified by Google as an inappropriate implementation in the browser component, carrying a CVSS 4.3 (Medium) with limited integrity impact and no confidentiality or availability consequence. No public exploit has been identified at time of analysis, EPSS exploitation probability stands at 0.02% (4th percentile), and Google's internal Chromium severity rating is Low - consistent signals pointing to a low-urgency, routine-patch item outside of specialized deployment contexts.

Technical ContextAI

The root cause is CWE-284 (Improper Access Control), specifically an 'inappropriate implementation' in Chrome's browser navigation subsystem - Google's taxonomy for logic-level flaws where browser-enforced policies are not correctly applied rather than memory-safety failures. Navigation restrictions in Chrome encompass cross-origin navigation guards, frame navigation policies (e.g., Content Security Policy frame-ancestors, sandbox attributes), and same-origin policy enforcement over APIs such as window.location, the History API, and iframe navigation. The crafted HTML page trigger indicates the attack surface lies in HTML/JavaScript-driven navigation parsing or policy evaluation logic. The affected product per ENISA EUVD-2026-34718 is Google Chrome across all desktop platforms (Windows, macOS, Linux) for versions below 149.0.7827.53, with no CPE string explicitly provided in the source data but implicitly cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* up to the fixed version.

RemediationAI

The primary remediation is upgrading Google Chrome to version 149.0.7827.53 or later via the stable channel, which contains the vendor-released patch for this issue. End users can update through Chrome's built-in mechanism (Menu → Help → About Google Chrome → update prompt), while enterprise administrators should deploy the update via Google Admin Console, Microsoft Intune, or equivalent MDM tooling. The authoritative advisory and release notes are at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Given the low CVSS score, Chromium Low severity rating, and 0.02% EPSS, this update can be applied within standard monthly patching cycles for most organizations. Exception: kiosk or locked-down deployments where browser navigation policy is a deliberate security boundary should treat this with higher urgency. No documented workarounds are available; patching is the only confirmed remediation.