What is the CVSS score of CVE-2026-11275?

CVE-2026-11275 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11275?

Yes, a patch is available for CVE-2026-11275. Update the affected software to the latest version immediately.

Google Chrome Android CVE-2026-11275

EUVD-2026-34736 MEDIUM

Improper Access Control (CWE-284)

2026-06-05 chrome-cve-admin@google.com

GHSA-6436-jh27-6vcx

Authentication Bypass Google

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

SUSE

MEDIUM

qualitative

Red Hat

3.9 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 20:55 vuln.today

CVSS changed

Jun 05, 2026 - 20:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 05, 2026 - 00:17 nvd

MEDIUM 6.5

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Page Info in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Navigation restriction bypass in Google Chrome for Android's Page Info component (prior to 149.0.7827.53) enables an attacker who has already compromised the renderer process to circumvent Chrome's navigation controls via a specially crafted HTML page. This is a chained exploitation scenario: the vulnerability cannot be triggered standalone but requires a prior renderer compromise as a prerequisite, limiting its practical threat surface. No public exploit has been identified at time of analysis, EPSS is negligible at 0.02%, and the vulnerability is not listed in CISA KEV. Google rates its internal severity as Low.

Technical ContextAI

The vulnerability resides in Chrome's Page Info UI component - the browser interface that exposes per-site metadata such as permissions, certificates, and navigation state. An 'inappropriate implementation' (CWE-284: Improper Access Control) in this component means that access control logic governing which navigations are permitted is incorrectly enforced when invoked from a compromised renderer context. Chrome's security model relies on renderer process sandboxing to prevent content-layer code from influencing privileged browser state; a flaw in the Page Info boundary allows a renderer-level attacker to craft HTML that triggers this logic incorrectly, bypassing navigation restrictions that should be enforced by the browser process. Affected product per EUVD data: Chrome for Android versions below 149.0.7827.53.

RemediationAI

Update Google Chrome for Android to version 149.0.7827.53 or later via the Google Play Store or Chrome's built-in update mechanism. This is the vendor-released patch per the Google Chrome Stable Channel Update advisory at chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Because this vulnerability requires prior renderer process compromise to be exploitable, organizations that maintain strong patch cadence for all Chrome CVEs (particularly renderer-targeted ones) will significantly reduce the risk of this issue being reachable. No actionable standalone workaround exists, as the underlying flaw is in browser-internal Page Info logic; disabling or restricting Chrome's Page Info UI is not a standard user-facing configuration option. The low EPSS and non-KEV status suggest standard patch cycle deployment is sufficient rather than emergency out-of-band remediation.