What is the CVSS score of CVE-2026-11266?

CVE-2026-11266 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11266?

Yes, a patch is available for CVE-2026-11266. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11266

EUVD-2026-34727 MEDIUM

Protection Mechanism Failure (CWE-693)

2026-06-05 chrome-cve-admin@google.com

GHSA-3hg6-58xq-85f8

Authentication Bypass Google

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.3 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 20:51 vuln.today

CVSS changed

Jun 05, 2026 - 20:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 05, 2026 - 00:17 nvd

MEDIUM 4.3

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in SafeBrowsing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass Safe Browsing via a malicious file. (Chromium security severity: Low)

AnalysisAI

SafeBrowsing protection mechanism bypass in Google Chrome prior to version 149.0.7827.53 allows remote unauthenticated attackers to deliver malicious files that evade Chrome's built-in phishing and malware detection layer. The bypass is triggered through user interaction - such as visiting a crafted page or downloading a manipulated file - without requiring any special privileges or configuration. No public exploit has been identified and EPSS is 0.02% (4th percentile), indicating low current exploitation probability; however, successful exploitation silently removes a critical user-facing protection layer, enabling downstream malware delivery.

Technical ContextAI

Google Chrome's SafeBrowsing subsystem performs real-time checks of URLs and downloaded files against Google's threat intelligence database, generating user-visible warnings for known malicious content. This vulnerability is classified as CWE-693 (Protection Mechanism Failure), indicating the safeguard exists but is implemented incorrectly such that a specially crafted file can circumvent the check entirely. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms the flaw is remotely triggerable, requires no attacker authentication or elevated privilege, and necessitates only standard user interaction (file download or page navigation). The scope is unchanged, meaning the bypass does not itself escape Chrome's sandbox. Affected products per EUVD cover all Chrome desktop builds prior to 149.0.7827.53.

RemediationAI

The vendor-released patch is Chrome version 149.0.7827.53, available via the stable channel update announced at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism will deploy this automatically for most consumer installations; enterprise administrators should verify rollout through Chrome Browser Cloud Management, Google Admin Console, or applicable Group Policy. No effective in-product workaround exists - disabling SafeBrowsing would eliminate the protection entirely rather than remediate the bypass. As a compensating control pending patch deployment, organizations should ensure independent web content filtering (e.g., Secure Web Gateway or DNS filtering) and endpoint detection with file scanning are active to provide a redundant layer of malicious file detection outside Chrome's native protection. Note that these compensating controls add operational overhead and may not match the coverage breadth of SafeBrowsing.