What is the CVSS score of CVE-2026-11267?

CVE-2026-11267 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11267?

Yes, a patch is available for CVE-2026-11267. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11267

EUVD-2026-34728 MEDIUM

Client-Side Enforcement of Server-Side Security (CWE-602)

2026-06-05 chrome-cve-admin@google.com

GHSA-93v7-558w-29j5

Authentication Bypass Google

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

3.9 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 20:51 vuln.today

CVSS changed

Jun 05, 2026 - 20:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 05, 2026 - 00:17 nvd

MEDIUM 4.3

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to bypass content security policy via a crafted Chrome Extension. (Chromium security severity: Low)

AnalysisAI

Content Security Policy bypass in Google Chrome prior to 149.0.7827.53 allows a remote attacker who convinces a victim to install a crafted malicious extension to circumvent CSP protections on web pages, enabling unauthorized content injection. The flaw stems from insufficient policy enforcement in Chrome's Extensions subsystem (CWE-602), rated Low severity by the Chromium security team with a CVSS base score of 4.3. No public exploit code exists and no active exploitation has been confirmed; EPSS is 0.01% (1st percentile), reflecting minimal real-world exploitation pressure at time of analysis.

Technical ContextAI

The vulnerability is rooted in CWE-602 (Client-Side Enforcement of Server-Side Security), meaning Chrome's extension engine incorrectly defers or inadequately enforces Content Security Policy - a browser-side security mechanism that restricts which scripts, styles, and resources a web page may load. Chrome extensions operate with elevated browser-internal privileges and can interact with page contexts in ways ordinary web content cannot; insufficient gating in extension policy enforcement allows a malicious extension to inject or execute content that CSP should have blocked. The affected product is Google Chrome across all desktop platforms prior to version 149.0.7827.53, as identified in the ENISA EUVD entry EUVD-2026-34728 and the Google Chrome Releases advisory.

RemediationAI

Vendor-released patch: Chrome 149.0.7827.53. Users and administrators should update Google Chrome to version 149.0.7827.53 or later via the browser's built-in update mechanism (Help > About Google Chrome) or via enterprise deployment tooling; details are available at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. As a compensating control prior to patching, enterprise administrators can restrict extension installation using Chrome's ExtensionInstallBlocklist and ExtensionInstallAllowlist group policies to prevent installation of untrusted or unreviewed extensions - note this may impact legitimate productivity extensions and requires an allowlist to be maintained. Enforcing the Chrome Web Store review policy and disabling developer mode extensions in managed environments also reduces the attack surface; however, these controls do not address the underlying policy enforcement flaw and should not substitute for patching.