What is the CVSS score of CVE-2026-11309?

CVE-2026-11309 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11309?

Yes, a patch is available for CVE-2026-11309. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11309

EUVD-2026-34770 MEDIUM

Origin Validation Error (CWE-346)

2026-06-05 chrome-cve-admin@google.com

GHSA-p2vw-mv4p-34vc

Information Disclosure Google

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 14:26 vuln.today

CVSS changed

Jun 05, 2026 - 14:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 05, 2026 - 00:17 nvd

MEDIUM 4.3

DescriptionCVE.org

Insufficient policy enforcement in History in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing via Chrome's History component (versions prior to 149.0.7827.53) lets an unauthenticated remote attacker deceive users through a crafted HTML page, exploiting insufficient policy enforcement in History navigation handling. The attacker can manipulate browser UI elements perceived by the victim, creating phishing-class deception without any confidentiality or availability impact - consistent with Chromium's own 'Low' severity rating. No public exploit code exists and EPSS sits at 0.03% (11th percentile), indicating very low probability of in-the-wild exploitation at time of analysis.

Technical ContextAI

The root cause is CWE-346 (Origin Validation Error), meaning Chrome's History subsystem fails to correctly enforce origin or policy boundaries when processing attacker-controlled HTML. This allows a malicious page to influence the browser's History state or visible UI in ways that should be blocked by same-origin or navigation policy controls. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms the attack is fully network-accessible, requires no authentication, has low attack complexity, but does require user interaction - specifically, the victim must visit the crafted page. The scope is unchanged (S:U), meaning the vulnerability is contained within the browser's rendering context and does not break out to the underlying OS. The EUVD-identified affected CPE range is Chrome versions below 149.0.7827.53.

RemediationAI

Update Google Chrome to version 149.0.7827.53 or later, which contains the vendor-released patch as confirmed by the June 2026 Stable Channel update advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism should apply this fix automatically on most deployments; administrators managing enterprise fleets should verify rollout via Chrome Browser Cloud Management or policy tooling. No workaround is documented for this issue. Given the low CVSS impact (integrity-only, no code execution) and the absence of active exploitation, patching can follow standard patch cycle cadence rather than emergency deployment. Restricting users from visiting untrusted or unvetted web content through proxy filtering or Safe Browsing policies provides an additional compensating control with minimal operational side effects.