What is the CVSS score of CVE-2026-11300?

CVE-2026-11300 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11300?

Yes, a patch is available for CVE-2026-11300. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11300

EUVD-2026-34761 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-05 chrome-cve-admin@google.com

GHSA-8w93-55h9-6w38

Information Disclosure Google Chrome

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 16:38 vuln.today

CVSS changed

Jun 05, 2026 - 16:22 NVD

4.3 (None) 4.3 (MEDIUM)

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 05, 2026 - 00:17 nvd

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in Permissions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome's Permissions subsystem prior to version 149.0.7827.53 enables remote unauthenticated attackers to misrepresent the browser's permission interface by delivering a crafted HTML page to a victim. The flaw (CWE-451) results in low-integrity impact - the attacker can deceive a user into perceiving a false permissions state, potentially manipulating consent decisions. No public exploit code exists, EPSS is 0.03% (8th percentile), CISA SSVC rates exploitation as none, and Chromium's own severity assessment is Low, placing this firmly in the routine-patching tier rather than an urgent response priority.

Technical ContextAI

CWE-451 (UI Misrepresentation of Critical Information) describes flaws where the interface presents misleading or falsified security-critical information to the user. In Chrome's Permissions subsystem, the browser displays prompts and indicators that communicate which origins have been granted access to sensitive capabilities (camera, location, notifications, etc.). An 'inappropriate implementation' in this subsystem - per Google's advisory language - means the logic governing how permission state is rendered or communicated can be subverted by attacker-controlled HTML content, causing the displayed UI to misrepresent actual permission grants or denials. The affected CPE range covers all Chrome Desktop builds prior to 149.0.7827.53 across platforms.

RemediationAI

Update Google Chrome to version 149.0.7827.53 or later - this is the vendor-released patch confirmed by the June 2026 Stable Channel Update advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome auto-updates by default on most desktop configurations; administrators managing enterprise fleets should verify deployment via Chrome Browser Cloud Management or group policy. No workarounds are documented for this vulnerability. Given that exploitation requires user interaction with a crafted HTML page, organizations with web content filtering or strict browsing controls gain some additional exposure reduction, but these are not substitutes for patching. The Chromium bug tracker reference (issues.chromium.org/issues/503614310) may provide additional technical detail once the issue is fully public.