What is the CVSS score of CVE-2026-11270?

CVE-2026-11270 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11270?

Yes, a patch is available for CVE-2026-11270. Update the affected software to the latest version immediately.

Chrome Android CVE-2026-11270

EUVD-2026-34731 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-05 chrome-cve-admin@google.com

GHSA-46gg-42jg-qq98

CSRF Google Chrome

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 20:52 vuln.today

CVSS changed

Jun 05, 2026 - 20:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 05, 2026 - 00:17 nvd

MEDIUM 6.5

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in UI in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Cross-origin data leakage in Google Chrome on Android (prior to 149.0.7827.53) enables remote unauthenticated attackers to exfiltrate data from other origins by directing a victim to a crafted HTML page that exploits an inappropriate UI implementation. The CVSS vector (AV:N/AC:L/PR:N/UI:R) reflects low-complexity network exploitation requiring only a single user interaction, with high confidentiality impact and no integrity or availability loss. No public exploit code and no active exploitation have been identified; an EPSS of 0.03% at the 11th percentile aligns with Chromium's own internal Low severity rating, placing this firmly in the patch-and-move-on category.

Technical ContextAI

The vulnerability resides in the Chrome browser's UI layer specifically on Android, where an inappropriate implementation creates a pathway for cross-origin data exfiltration. CWE-352 (Cross-Site Request Forgery) is assigned and the 'CSRF' tag is present, suggesting the underlying mechanism involves a CSRF-class flaw in which Chrome's Android UI fails to enforce proper cross-origin isolation - potentially allowing a forged or crafted page to trigger requests that read responses protected by the same-origin policy. Android's divergent UI rendering and request-handling stack compared to desktop Chrome may introduce platform-specific gaps in origin enforcement. The affected product is Google Chrome on Android, all versions prior to 149.0.7827.53, as confirmed by EUVD-2026-34731. The mismatch between a data-leakage outcome and a CSRF CWE assignment may reflect a CSRF-assisted read primitive rather than a classic state-changing CSRF - a nuance not fully resolved by available references.

RemediationAI

Update Google Chrome on Android to version 149.0.7827.53 or later, available via the Google Play Store or Chrome's built-in update mechanism. The vendor advisory is published at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. The Chromium issue tracker entry is at https://issues.chromium.org/issues/501504245. If immediate update is not feasible, the only meaningful compensating control is restricting user exposure to untrusted HTML content - specifically advising Android Chrome users to avoid following links from unverified sources - since exploitation is gated on the victim visiting a crafted page (UI:R). No additional workarounds are confirmed by the vendor in available references, and given the low exploitation risk this mitigation is a precaution rather than an urgent necessity.