What is the CVSS score of CVE-2026-11283?

CVE-2026-11283 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11283?

Yes, a patch is available for CVE-2026-11283. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11283

EUVD-2026-34744 MEDIUM

Improper Input Validation (CWE-20)

2026-06-05 chrome-cve-admin@google.com

GHSA-rg8m-36hp-4ghf

Authentication Bypass Google

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 20:57 vuln.today

CVSS changed

Jun 05, 2026 - 20:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 05, 2026 - 00:17 nvd

MEDIUM 6.5

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in Shortcuts in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a malicious file. (Chromium security severity: Low)

AnalysisAI

Navigation restriction bypass in Google Chrome's Shortcuts feature on macOS allows remote attackers to circumvent Chrome's internal URL filtering or navigation controls via a crafted malicious file. Affected versions are all Chrome releases on Mac prior to 149.0.7827.53. The CVSS vector (PR:N, UI:R, I:H) indicates no attacker authentication is required but user interaction with the malicious file is mandatory; EPSS at 0.02% (4th percentile) and no public exploit identified at time of analysis confirm low exploitation probability, consistent with Chromium's own 'Low' severity rating.

Technical ContextAI

The vulnerability resides in the Shortcuts component of Google Chrome on macOS. CWE-20 (Improper Input Validation) identifies the root cause as insufficient sanitization of untrusted, externally-supplied input before it is processed by the Shortcuts subsystem. This component likely handles macOS shortcut or URL file formats, and when parsing attacker-controlled content, fails to enforce Chrome's navigation restrictions - such as URL scheme controls, SafeBrowsing filters, or cross-origin navigation policies. The macOS-only scope suggests the flaw may intersect with platform-specific file handling behavior. No CPE string was provided in the input data; the affected product is identified via EUVD and NVD description as Google Chrome on Mac prior to version 149.0.7827.53.

RemediationAI

Update Google Chrome on macOS to version 149.0.7827.53 or later; this is the vendor-released patch confirmed via the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and corroborated by EUVD-2026-34744. For organizations unable to patch immediately, a compensating control is to restrict users from opening untrusted shortcut or URL-type files through endpoint DLP or file association policies - note this may disrupt workflows that rely on .url or shortcut files. Enterprise administrators can also enforce Chrome policy to disable or restrict the Shortcuts feature if the feature is non-essential, accepting reduced functionality as a trade-off. Chrome's built-in auto-update mechanism should handle consumer endpoints automatically.