What is the CVSS score of CVE-2026-11260?

CVE-2026-11260 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11260?

Yes, a patch is available for CVE-2026-11260. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11260

EUVD-2026-34721 MEDIUM

Protection Mechanism Failure (CWE-693)

2026-06-05 chrome-cve-admin@google.com

GHSA-qpvw-56rj-7fxm

Authentication Bypass Google Chrome

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

5.4 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 20:49 vuln.today

CVSS changed

Jun 05, 2026 - 20:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 05, 2026 - 00:17 nvd

MEDIUM 4.3

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Permissions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Content Security Policy bypass in Google Chrome prior to 149.0.7827.53 stems from an inappropriate implementation in the browser's Permissions subsystem, enabling a remote attacker to circumvent CSP restrictions through a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms the impact is limited to a partial integrity violation - no confidentiality or availability consequences are indicated. No public exploit identified at time of analysis; EPSS at 0.01% (2nd percentile) and Chromium's own 'Low' severity rating together indicate very low near-term exploitation likelihood.

Technical ContextAI

Google Chrome's Permissions subsystem contains an inappropriate implementation (CWE-693: Protection Mechanism Failure) that insufficiently enforces Content Security Policy constraints under certain conditions. CSP is a browser-enforced security mechanism that restricts which resources a page may load, execute, or communicate with - a bypass allows attacker-controlled content to side-step these restrictions. The flaw resides in how the Permissions layer interacts with CSP enforcement logic, such that a specially constructed HTML page can trigger a code path that skips or incorrectly evaluates policy directives. Affected versions span all Chrome stable releases prior to 149.0.7827.53, per EUVD-2026-34721 and NVD CPE data. The Chromium issue tracker reference (issues.chromium.org/issues/499257860) is cited but its internal details are not publicly disclosed.

RemediationAI

Upgrade Google Chrome to version 149.0.7827.53 or later, which contains the vendor-released patch for this CSP bypass. Google published the stable channel release notes at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. For most end users, Chrome's built-in auto-update mechanism will apply this fix automatically; administrators managing enterprise fleets should verify deployment via Chrome Browser Cloud Management or equivalent policy tooling. If immediate patching is not feasible, restricting users from visiting untrusted or externally-sourced HTML pages via web-filtering proxies reduces exposure, though this is an operational workaround with usability trade-offs and does not address the root cause. Given the low severity and limited impact scope, no emergency out-of-band remediation cadence is warranted unless the environment has specific CSP-dependent security controls that are critical to its threat model.