What is the CVSS score of CVE-2026-11302?

CVE-2026-11302 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11302?

Yes, a patch is available for CVE-2026-11302. Update the affected software to the latest version immediately.

Chrome for iOS CVE-2026-11302

EUVD-2026-34763 MEDIUM

Improper Access Control (CWE-284)

2026-06-05 chrome-cve-admin@google.com

GHSA-p8xv-rjmj-8264

Authentication Bypass Google Apple

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 16:38 vuln.today

CVSS changed

Jun 05, 2026 - 16:22 NVD

4.3 (None) 4.3 (MEDIUM)

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 05, 2026 - 00:17 nvd

MEDIUM 4.3

DescriptionCVE.org

Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Insufficient policy enforcement in Google Chrome for iOS (prior to 149.0.7827.53) allows remote unauthenticated attackers to bypass discretionary access controls via a crafted HTML page, resulting in limited integrity impact. User interaction is required, and exploitation probability is extremely low - EPSS sits at 0.02% (4th percentile). No public exploit identified at time of analysis, and Chromium's own security team rated this as 'Low' severity, consistent with the CVSS 4.3 score and SSVC's 'partial' technical impact assessment.

Technical ContextAI

The vulnerability is rooted in CWE-284 (Improper Access Control), specifically insufficient enforcement of discretionary access control policies within Chrome's iOS-specific rendering or content handling layer. Chrome for iOS operates under Apple's WKWebView framework rather than Blink's full desktop sandbox, which introduces platform-specific policy enforcement paths that may diverge from desktop Chrome behavior. The crafted HTML page delivery vector suggests the flaw lies in how web content triggers or interacts with internal Chrome iOS policy checks. The CPE context (iOS-specific builds prior to 149.0.7827.53, confirmed via EUVD) means this does not affect Chrome on Android, Windows, macOS, or Linux - only the iOS distribution is in scope.

RemediationAI

Update Google Chrome for iOS to version 149.0.7827.53 or later, available through the Apple App Store. This is the vendor-released patch confirmed by the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. No workaround is documented. If immediate patching is not feasible in managed environments, restricting user access to untrusted or externally-hosted HTML content via Mobile Device Management (MDM) policy - for example, URL allowlisting through browser management profiles - can reduce exposure, though this may impact user productivity. Given the low severity and the absence of active exploitation, emergency compensating controls are not warranted; standard patch cycle management is appropriate.