What is the CVSS score of CVE-2026-11297?

CVE-2026-11297 has a contested CVSS base score of 7.7 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11297?

Google Chrome on Android versions prior to 149.0.7827.53 contain a Reader Mode input validation bypass allowing local attackers to circumvent security controls via malicious files.. A patch is available.

How to fix or mitigate CVE-2026-11297?

24 hours: Enable automatic Chrome updates for all managed Android devices and inventory current Chrome versions across the mobile fleet. 7 days: Verify Chrome has updated to vendor-released patch version 149.0.7827.53 or later; accelerate manual updates on devices lacking automatic update capability. 30 days: Complete compliance audit confirming 100% of Android devices running Chrome 149.0.7827.53 or later.

Google Chrome CVE-2026-11297

EUVD-2026-34758 HIGH

Improper Input Validation (CWE-20)

2026-06-05 chrome-cve-admin@google.com

GHSA-jqx5-hg9f-r3hf

Authentication Bypass Google Chrome

High

Disputed · 7.7 NVD

Severity by source

Sources disagree (Low–High)

NVD PRIMARY

7.7 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

2.8 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 16:26 vuln.today

CVSS changed

Jun 05, 2026 - 16:22 NVD

7.7 (None) 7.7 (HIGH)

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 05, 2026 - 00:17 nvd

HIGH 7.7

DescriptionCVE.org

Insufficient validation of untrusted input in Reader Mode in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to bypass navigation restrictions via a malicious file. (Chromium security severity: Low)

AnalysisAI

Navigation restriction bypass in Google Chrome on Android prior to 149.0.7827.53 allows a local attacker to circumvent Reader Mode input validation by supplying a malicious file. No public exploit identified at time of analysis, and EPSS scores exploitation probability at just 0.02% (4th percentile), but Google has released a fix in the stable channel. Chromium internally rates this as Low severity despite the elevated NVD CVSS of 7.7.

Technical ContextAI

The flaw resides in Chrome's Reader Mode feature on the Android platform, which reformats web content for distraction-free reading. The root cause is CWE-20 (Improper Input Validation): Reader Mode insufficiently validates untrusted input from a file source, permitting navigation constraints that normally isolate the rendering context to be bypassed. Reader Mode operates as a privileged Chrome view that strips page chrome and re-renders DOM content, so weak input handling there can break expected origin/scheme boundaries that Chrome's navigation policies enforce.

RemediationAI

Vendor-released patch: update Google Chrome on Android to 149.0.7827.53 or later via Google Play, as announced in the Chrome Releases stable channel update at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. In managed-device fleets, push the updated Chrome APK through MDM and verify rollout against version 149.0.7827.53. As a compensating control before patching, instruct users to avoid opening untrusted local files (file:// scheme content, downloaded HTML/MHTML) in Chrome and to disable Reader Mode under chrome://flags or via enterprise policy, accepting the trade-off that accessibility users relying on Reader Mode will lose that simplified-rendering capability.