What is the CVSS score of CVE-2026-11261?

CVE-2026-11261 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11261?

Yes, a patch is available for CVE-2026-11261. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11261

EUVD-2026-34722 MEDIUM

Improper Input Validation (CWE-20)

2026-06-05 chrome-cve-admin@google.com

GHSA-phx2-2x4x-g268

Information Disclosure Google Chrome

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

2.8 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 20:49 vuln.today

CVSS changed

Jun 05, 2026 - 20:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 05, 2026 - 00:17 nvd

MEDIUM 4.3

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in PDF in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome's PDF implementation prior to version 149.0.7827.53 can be triggered by a remote attacker who has already compromised the renderer process, using a crafted HTML page to mislead users through false interface elements. The vulnerability is rated Low severity by the Chromium security team, with a CVSS score of 4.3, and carries a negligible exploitation probability (EPSS 0.05%, 15th percentile). No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog, making real-world exploitation highly unlikely outside of sophisticated, chained attack scenarios.

Technical ContextAI

The flaw is rooted in CWE-20 (Improper Input Validation) within Chrome's PDF rendering component, where inappropriate implementation allows crafted HTML content to manipulate the browser's user interface presentation. The attack surface is Chrome's PDF subsystem, which processes PDF-embedded or PDF-adjacent HTML content inside the renderer process sandbox. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) indicates a network-delivered attack requiring user interaction, with only low integrity impact and no confidentiality or availability consequences. Crucially, the vulnerability description specifies that renderer process compromise is a prerequisite, placing this firmly in the category of a post-exploitation or chained exploit primitive rather than a standalone entry point. Affected versions are all Chrome releases prior to 149.0.7827.53 across desktop platforms.

RemediationAI

The primary remediation is to update Google Chrome to version 149.0.7827.53 or later, which is confirmed as the vendor-released patch per the stable channel update advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism will apply this fix automatically in most enterprise and consumer environments; administrators should verify update policies are not blocking delivery. Because exploitation requires a prior renderer process compromise as a precondition, organizations with Chrome running in strict site isolation mode (-site-per-process, which is the default in modern Chrome) already benefit from a significant structural defense that limits the blast radius of renderer compromises generally. No compensating control specifically addresses this UI spoofing flaw in lieu of patching, but restricting access to untrusted web content and PDF sources through proxy or DNS filtering reduces overall exposure to the renderer exploit chain that would need to precede this vulnerability.