What is the CVSS score of CVE-2026-11653?

CVE-2026-11653 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-11653?

Yes, a patch is available for CVE-2026-11653. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11653

EUVD-2026-35253 MEDIUM

Improper Input Validation (CWE-20)

2026-06-09 chrome-cve-admin@google.com

GHSA-5cc5-fjm9-c96q

Authentication Bypass Google

Medium

Disputed · 6.5 NVD

Severity by source

Sources disagree (Medium–Critical)

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

SUSE

CRITICAL

qualitative

Red Hat

8.7 HIGH

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 14:25 vuln.today

CVSS changed

Jun 09, 2026 - 14:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

MEDIUM 6.5

DescriptionNVD

Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Site isolation bypass in Google Chrome Extensions (versions prior to 149.0.7827.103) enables a remote attacker who has already compromised the renderer process to escape cross-origin content boundaries via a crafted HTML page. The vulnerability stems from improper input validation (CWE-20) in the Extensions subsystem, producing a high integrity impact (I:H) with no confidentiality or availability loss per the CVSS vector. No public exploit code exists and no active exploitation has been confirmed, with EPSS at 0.02% (6th percentile), consistent with a chained, high-complexity attack path.

Technical ContextAI

Google Chrome's site isolation architecture partitions web content across separate renderer processes to enforce cross-origin security boundaries. The affected component is the Extensions subsystem, which interfaces with renderer process privileges to provide extension APIs. CWE-20 (Improper Input Validation) as the root cause indicates that crafted input - delivered via a specially constructed HTML page - is not properly validated within the Extensions implementation, allowing it to influence cross-origin boundaries it should not be able to reach. Affected CPE is implicitly Google Chrome prior to version 149.0.7827.103 on all supported desktop platforms (Windows, macOS, Linux), as confirmed by the EUVD affected versions range 'Chrome 149.0.7827.103 < 149.0.7827.103' and the Chrome Stable Channel release advisory.

RemediationAI

The primary fix is upgrading Google Chrome to version 149.0.7827.103 or later, which is the vendor-confirmed patched release documented in the Chrome Stable Channel advisory at chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html. Chrome typically applies updates automatically when the browser is restarted; administrators managing enterprise deployments should push the update via Google Admin Console or equivalent MDM tooling. If immediate upgrade is not feasible, a targeted compensating control is disabling or tightly restricting browser extensions to a vetted allowlist via enterprise policy, which limits the attack surface of the vulnerable Extensions subsystem; note that this may break legitimate extension-dependent workflows. Additionally, since the attack chain requires prior renderer process compromise, prioritizing any other outstanding Chrome renderer vulnerabilities for patching reduces the precondition likelihood. No additional workarounds are documented in the referenced advisories.