What is the CVSS score of CVE-2026-11265?

CVE-2026-11265 has a contested CVSS base score of 7.5 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11265?

Google Chrome versions prior to 149.0.7827.53 contain a cross-origin data leakage vulnerability in the Autofill component that could expose user passwords and form data if a victim visits a crafted…. A patch is available.

How to fix or mitigate CVE-2026-11265?

Within 24 hours: Audit Chrome deployment scope and patch status across organization. Within 7 days: Deploy Chrome 149.0.7827.53 or later via standard patch management. Within 30 days: Verify 100% compliance and monitor for any exploitation signals or related Autofill variants.

Google Chrome CVE-2026-11265

EUVD-2026-34726 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-05 chrome-cve-admin@google.com

GHSA-2pq7-3f5g-vmjh

Google CSRF

High

Disputed · 7.5 Vendor: google

Severity by source

Sources disagree (Low–High)

Vendor (google) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SUSE

HIGH

qualitative

Red Hat

7.4 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 20:26 vuln.today

CVSS changed

Jun 05, 2026 - 20:22 NVD

7.5 (HIGH)

CVE Published

Jun 05, 2026 - 00:17 nvd

HIGH 7.5

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Cross-origin data leakage in Google Chrome's Autofill component prior to version 149.0.7827.53 enables remote attackers to exfiltrate sensitive data from other origins by enticing a victim to visit a crafted HTML page. Despite a CVSS score of 7.5 reflecting high confidentiality impact, the EPSS score of 0.03% and Chromium's own 'Low' severity rating indicate limited real-world risk, and no public exploit identified at time of analysis.

Technical ContextAI

The flaw resides in Chrome's Autofill subsystem, which stores and inserts user data (addresses, payment info, credentials) into web form fields. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery), suggesting that the Autofill implementation does not adequately enforce the same-origin policy or anti-CSRF controls when handling data fills across origins. A crafted page can therefore coerce the browser into disclosing data tied to a different origin, breaking the web's fundamental isolation guarantee. The affected component is Chromium's browser-side Autofill module shipped in Google Chrome for desktop, as confirmed by the chromereleases.googleblog.com stable channel announcement.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - upgrade desktop installations to this version or later via the built-in auto-updater or by restarting the browser after Chrome reports an update is ready, then verify via chrome://settings/help. Enterprises managing Chrome through Google Admin Console, group policy, or Workspace updater channels should confirm the stable channel pin is current and force-restart any long-running browser sessions, since the Autofill component cannot be selectively disabled without significantly degrading usability. Where immediate patching is not possible, a partial compensating control is to disable Autofill for addresses and payment methods under chrome://settings/autofill - this prevents cross-origin leakage of stored data at the cost of user convenience, but does not eliminate session-scoped autofill behavior. Authoritative advisory: https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html.