What is the CVSS score of CVE-2026-11273?

CVE-2026-11273 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-11273?

Yes, a patch is available for CVE-2026-11273. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11273

EUVD-2026-34734 MEDIUM

Improper Input Validation (CWE-20)

2026-06-05 chrome-cve-admin@google.com

GHSA-73fj-mp7h-8c8w

Google Code Injection

6.1

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

9.3 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 20:54 vuln.today

CVSS changed

Jun 05, 2026 - 20:22 NVD

6.1 (MEDIUM)

CVE Published

Jun 05, 2026 - 00:17 nvd

MEDIUM 6.1

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Universal Cross-Site Scripting (UXSS) in the Omnibox component of Google Chrome prior to 149.0.7827.53 enables a remote unauthenticated attacker to inject arbitrary scripts or HTML across origin boundaries by exploiting insufficient input validation. Successful exploitation requires convincing a victim to visit a crafted HTML page and perform specific UI gestures, as confirmed by the UI:R CVSS component and the CVE description. No public exploit has been identified at time of analysis, and the EPSS score of 0.07% (22nd percentile) combined with Google's own 'Low' severity classification indicates limited near-term exploitation likelihood.

Technical ContextAI

The Omnibox is Chrome's unified address and search bar, responsible for processing and rendering URLs, search queries, and navigation input. CWE-20 (Improper Input Validation) identifies the root cause as a failure to adequately sanitize or validate attacker-influenced input before it is processed by the Omnibox, enabling script or HTML injection. The resulting UXSS class of vulnerability is particularly significant because it bypasses the browser's Same-Origin Policy, allowing injected code to execute in the context of arbitrary origins - not just the attacker's page. The CVSS Scope:Changed (S:C) metric formally captures this cross-boundary impact. Affected product per EUVD version data is Google Chrome desktop versions in the range below 149.0.7827.53, with no platform-specific CPE constraint indicated in available data.

RemediationAI

The primary remediation is upgrading Google Chrome to version 149.0.7827.53 or later, which is the vendor-released fix confirmed via the Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome updates automatically for most users; enterprise administrators should verify deployment via policy management tools (e.g., Google Admin Console, Intune) and confirm version compliance. For environments where patching is delayed, a compensating control is to enforce URL allowlisting through a proxy or DNS filtering layer to prevent users from reaching attacker-controlled pages - this reduces attack surface but significantly impacts general browsing capability. Enabling Chrome's Enhanced Protection mode under Safe Browsing settings may provide additional detection of malicious pages but does not patch the underlying Omnibox validation flaw. No workaround fully neutralizes the vulnerability without updating to 149.0.7827.53.