What is the CVSS score of CVE-2026-11258?

CVE-2026-11258 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11258?

Yes, a patch is available for CVE-2026-11258. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11258

EUVD-2026-34719 MEDIUM

Improper Access Control (CWE-284)

2026-06-05 chrome-cve-admin@google.com

GHSA-qx55-562j-v29w

Authentication Bypass Google Chrome

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 20:48 vuln.today

CVSS changed

Jun 05, 2026 - 20:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 05, 2026 - 00:17 nvd

MEDIUM 6.5

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in File System Access in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

File System Access API in Google Chrome prior to 149.0.7827.53 allows a remote attacker to bypass discretionary access control (DAC) by convincing a user to perform specific UI gestures on a crafted HTML page. The CVSS vector (I:H, C:N, A:N) confirms the impact is limited to unauthorized file integrity compromise - an attacker could write or modify local files beyond what the user explicitly permitted. No public exploit code exists and EPSS is 0.02% (4th percentile), aligning with Chromium's own internal 'Low' severity rating, indicating limited real-world exploitation likelihood at time of analysis.

Technical ContextAI

The File System Access API (formerly Native File System API) enables web applications to read and write files on a user's local filesystem, typically gated by explicit user permission prompts. The root cause is CWE-284 (Improper Access Control) - specifically an 'inappropriate implementation' in how Chrome enforces discretionary access control boundaries within this API. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U) confirms the attack is network-delivered, requires no attacker authentication, and relies on user interaction to trigger the flaw. The scope is unchanged (S:U), meaning impact is confined to the browser's own access context and does not escape to the underlying OS in a broader sense. Affected versions are confirmed as all Chrome releases prior to 149.0.7827.53 per EUVD-2026-34719. No CPE strings were included in the source data.

RemediationAI

The primary fix is to update Google Chrome to version 149.0.7827.53 or later, which contains the vendor-released patch as documented at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome typically applies updates automatically; enterprise administrators should verify patch deployment via Chrome Enterprise management tools or endpoint inventory. As a compensating control prior to patching, administrators can consider restricting or blocking web applications that invoke the File System Access API via enterprise browser policies (e.g., the FileSystemAccessAskForContent policy or equivalent), though this may degrade legitimate web application functionality that relies on local file access. No workaround fully eliminates the underlying implementation flaw - patching to 149.0.7827.53 is the definitive remediation.