What is the CVSS score of CVE-2026-11291?

CVE-2026-11291 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11291?

Yes, a patch is available for CVE-2026-11291. Update the affected software to the latest version immediately.

Chrome Android CVE-2026-11291

EUVD-2026-34752 MEDIUM

Origin Validation Error (CWE-346)

2026-06-05 chrome-cve-admin@google.com

GHSA-fx7j-vvw6-f528

Authentication Bypass Google Chrome

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

9.3 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 21:01 vuln.today

CVSS changed

Jun 05, 2026 - 20:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 05, 2026 - 00:17 nvd

MEDIUM 4.3

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Android Autofill in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Same-origin policy bypass in Google Chrome's Android Autofill implementation allows remote unauthenticated attackers to perform limited cross-origin integrity violations by delivering a crafted HTML page to a victim user. Affected are all Chrome for Android versions prior to 149.0.7827.53. Impact is constrained to integrity (I:L) with no confidentiality or availability consequence, consistent with Chromium's own 'Low' severity rating. No public exploit code exists and no active exploitation has been confirmed; EPSS exploitation probability sits at 0.02% (4th percentile), making this a low operational priority despite being network-reachable.

Technical ContextAI

The root cause is classified as CWE-346 (Origin Validation Error), meaning the Android Autofill subsystem fails to properly enforce same-origin policy boundaries when processing data from a remotely-delivered HTML page. The Android Autofill framework is an OS-level API that Chrome integrates with to surface fill suggestions; the flaw lies in Chrome's Android-specific implementation of that integration, not in the core Blink rendering engine or desktop Chrome. Because the Autofill bridge operates at an OS/browser interface layer, origin isolation logic that would normally constrain cross-origin data access may not be consistently applied, allowing attacker-controlled HTML to influence or interact with content governed by a different origin. The affected CPE maps to Chrome on Android prior to version 149.0.7827.53, as confirmed by the ENISA EUVD entry EUVD-2026-34752.

RemediationAI

Update Google Chrome on Android to version 149.0.7827.53 or later via the Google Play Store; this is the vendor-released patch confirmed through the Chrome Stable Channel update advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. For organizations unable to update immediately, a compensating control is to disable or restrict Android Autofill for Chrome through enterprise mobile device management (MDM) policy, which removes the vulnerable code path at the cost of losing Autofill convenience for end users. Restricting access to untrusted or external web content via browser policy or network filtering can reduce exposure, as exploitation requires user navigation to a crafted page. Given the low EPSS score and absence of known active exploitation, emergency patching is not warranted; inclusion in the next scheduled patch cycle is appropriate for most deployments.