What is the CVSS score of CVE-2026-11264?

CVE-2026-11264 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11264?

Yes, a patch is available for CVE-2026-11264. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11264

EUVD-2026-34725 MEDIUM

Protection Mechanism Failure (CWE-693)

2026-06-05 chrome-cve-admin@google.com

GHSA-hw98-4hg3-42jx

Authentication Bypass Google Chrome

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

5.4 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 20:50 vuln.today

CVSS changed

Jun 05, 2026 - 20:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 05, 2026 - 00:17 nvd

MEDIUM 4.3

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Policy bypass in Content Security Policy in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Content Security Policy bypass in Google Chrome prior to version 149.0.7827.53 enables remote attackers to circumvent CSP protections via a crafted HTML page, with the victim's browser failing to enforce declared content restrictions. The vulnerability requires user interaction (UI:R) and produces limited integrity impact (I:L) only - no confidentiality or availability loss. EPSS at 0.02% (4th percentile) and no CISA KEV listing indicate negligible current exploitation activity; Chromium has internally rated this Low severity, aligning with the constrained impact scope.

Technical ContextAI

Content Security Policy is a W3C-standardized browser enforcement mechanism that restricts which resources (scripts, styles, frames, etc.) a page is permitted to load, serving as a critical defense-in-depth layer against XSS and data injection. CWE-693 (Protection Mechanism Failure) identifies the root cause class: the browser's CSP enforcement logic fails to correctly apply the declared policy when processing a specially constructed HTML document, allowing policy-restricted content to load. The affected component is Chrome's CSP implementation across all desktop platforms. Affected CPE is inferred as cpe:/a:google:chrome across versions prior to 149.0.7827.53 based on ENISA EUVD-2026-34725 and the NVD entry. The exact internal parsing or policy-application flaw is not publicly disclosed; the Chromium issue tracker at issues.chromium.org/issues/500099106 may contain further technical detail but is not reproduced in available intelligence.

RemediationAI

Update Google Chrome to version 149.0.7827.53 or later; this is the vendor-released patch confirmed via the Google stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome auto-updates by default on most desktop deployments, so the majority of endpoints will receive the fix without manual intervention - verify update status via chrome://settings/help. For environments where Chrome auto-update is managed or disabled (enterprise deployments), push the 149.0.7827.53 update through fleet management tooling. If immediate patching is not feasible, a partial compensating control is to enforce server-side CSP headers with strict directives and monitor CSP violation reports (report-uri/report-to), though these are server-side measures and do not directly remediate a client-side enforcement bypass. No other workarounds are described in available references.