What is the CVSS score of CVE-2026-11685?

CVE-2026-11685 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-11685?

Yes, a patch is available for CVE-2026-11685. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11685

EUVD-2026-35211 MEDIUM

Improper Input Validation (CWE-20)

2026-06-09 chrome-cve-admin@google.com

GHSA-6v8q-g97g-72xj

Information Disclosure Google

Medium

Disputed · 4.3 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

SUSE

CRITICAL

qualitative

Red Hat

7.4 HIGH

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 02:58 vuln.today

CVSS changed

Jun 09, 2026 - 02:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in MediaCapture in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Cross-origin data leakage in Google Chrome's MediaCapture implementation on macOS allows a remote attacker to read data from other origins by enticing a user to visit a specially crafted HTML page. Affected versions are all Chrome releases on Mac prior to 149.0.7827.103. The flaw carries a CVSS score of 4.3 (Medium) with no authentication required, though user interaction is necessary; no public exploit code has been identified at time of analysis, and the issue is not listed in the CISA KEV catalog.

Technical ContextAI

MediaCapture is the browser-level API layer (exposed via getUserMedia and related interfaces) responsible for capturing audio, video, and screen content. The root cause is classified as CWE-20 (Improper Input Validation), meaning Chrome's Mac-specific MediaCapture code path fails to adequately validate or sanitize inputs in a way that enforces the same-origin policy, inadvertently exposing data belonging to cross-origin contexts. This class of flaw typically arises when platform-specific implementation code bypasses or incompletely implements security checks enforced elsewhere in the browser engine. The defect is Mac-platform-specific - the description explicitly scopes it to Chrome on Mac - suggesting a divergence in how the MediaCapture subsystem was implemented or integrated with macOS system APIs compared to other platforms.

RemediationAI

Update Google Chrome on Mac to version 149.0.7827.103 or later. Google has released a patch in the stable channel as documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html. Chrome's auto-update mechanism will deliver this update automatically; users and administrators should verify the installed version via chrome://settings/help and force an update check if needed. For managed enterprise environments, deploy the updated MSI/PKG via fleet management tooling (e.g., Jamf, Munki, Intune) targeting macOS endpoints. If immediate patching is not feasible, a compensating control is to disable or restrict access to MediaCapture via enterprise policy (e.g., setting VideoCaptureAllowed and AudioCaptureAllowed to disabled), though this will break legitimate camera and microphone functionality across all sites - a significant operational trade-off. Blocking the specific crafted delivery vector via web proxy or browser isolation tools (e.g., sandboxed remote browser isolation) can also reduce exposure without disabling MediaCapture globally.