What is the CVSS score of CVE-2026-11272?

CVE-2026-11272 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome iOS are affected by CVE-2026-11272?

Google Chrome for iOS prior to version 149.0.7827.53 contains a privilege escalation vulnerability in the Reading List feature that could allow remote attackers to escalate privileges when users…. A patch is available.

How to fix or mitigate CVE-2026-11272?

Within 24 hours: Issue security notification to iOS users about the Chrome update requirement; within 7 days: Deploy Google Chrome for iOS 149.0.7827.53 through MDM, automatic app updates, and organizational app distribution channels; within 30 days: Verify deployment completion and assess any exploitation attempts.

Google Chrome iOS CVE-2026-11272

EUVD-2026-34733 HIGH

Improper Input Validation (CWE-20)

2026-06-05 chrome-cve-admin@google.com

GHSA-wgh9-28v2-8v35

Apple Google Privilege Escalation Red Hat

High

Disputed · 8.8 NVD

Severity by source

Sources disagree (Low–High)

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 20:27 vuln.today

CVSS changed

Jun 05, 2026 - 20:22 NVD

8.8 (HIGH)

CVE Published

Jun 05, 2026 - 00:17 nvd

HIGH 8.8

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in Reading List in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Privilege escalation in Google Chrome for iOS prior to 149.0.7827.53 allows remote attackers to elevate privileges when a victim is lured into performing specific UI gestures on a crafted HTML page. The flaw stems from insufficient input validation in the Reading List feature and carries a CVSS 3.1 score of 8.8, though EPSS is low at 0.05% and no public exploit identified at time of analysis. Google rates the underlying Chromium severity as Low despite the high CVSS, suggesting realistic exploitability is constrained by the required user interaction.

Technical ContextAI

The vulnerability lives in Chrome's Reading List component on the iOS platform, a feature that saves web pages for offline reading and is implemented via Chromium's iOS port (which uses WebKit under Apple's App Store policies rather than Blink). The root cause is classified as CWE-20 (Improper Input Validation), meaning data parsed from an attacker-controlled HTML page is not sufficiently sanitized before being acted upon, enabling an unintended state transition or action when combined with crafted UI interactions. Because Chrome on iOS shares the system WebKit engine but layers Chromium UI and feature code on top, the Reading List handler is part of Google's own iOS-specific code path rather than upstream Blink.

RemediationAI

Vendor-released patch: Chrome for iOS 149.0.7827.53 - update via the Apple App Store as the primary fix, referencing the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and the Chromium issue tracker entry at https://issues.chromium.org/issues/501747321. Because Chrome on iOS auto-updates through the App Store, ensure managed iOS fleets (MDM-supervised devices) have App Store updates enabled or push the updated build via managed app distribution. As a temporary compensating control where patching is delayed, advise users to avoid using the Reading List feature on untrusted pages and to refrain from performing prompted UI gestures (long-press, share-sheet interactions) on unfamiliar sites; the trade-off is loss of Reading List usability but no other functional impact. There is no server-side or network-layer mitigation that meaningfully blocks this client-side issue.